sudo and OpenDoas timestamp files (2020)

Barely qualifies for the security tag.

I actually just stumbled onto this yesterday, while switching to Gentoo. OpenDoas disables persist by default:

This feature is new and potentially dangerous, in the original doas, a kernel API is used to set and clear timeouts. This API is OpenBSD specific and no similar API is available on other operating systems.

Most distros re-enable it for you, but in Gentoo you need to switch on an USE flag for this manually. I've always wondered how the sudo timeout works, but never actually investigated it. This is pretty clever (and it's nice that as a result of an unofficial port of doas to Linux, sudo improved too)!

The original doas seems to use the TIOCSETVERAUTH ioctl on the tty instead, callable only by root.

I think this is the first Lobsters article I've seen with a non-ASCII letter in the domain name.