FreeBSD 15: Why You’ll Want It
33 points by eduard
33 points by eduard
It'll be interesting to see if mdo(1) attracts attention in third-party software as an alternative to sudo and doas.
The note under "SECURITY CONSIDERATIONS" makes it sound like it is not really an alternative to sudo and doas in most cases.
The mdo program is geared to role-based scenarios. Consequently, it does not ask for any password or request other form of authentication before trying to establish new credentials, instead relying solely on the requester's credentials for this purpose.
Yeah, in the announcement
FreeBSD introduces a native mechanism for controlled privilege escalation via mdo(1) and mac_do(4). This provides a built-in alternative to installing tools like sudo or doas when users need limited administrative capabilities.
I'm curious when you'd reach for it.
For instance if you have a deployment user, who'll need to restart a service after installing a new version of it. In Linux I'd allow a passwordless invocation of a tightly controlled script to solve the same use case.
oh okay -- i was thinking it was a replacement, but it seems like I'll need to install doas anyway?