pfexec(1) on Solnix vs Linux and the BSDs
pfexec is the illumos /usr/bin/pfexec. It runs a command with the attributes your RBAC profiles grant in exec_attr(5), not by switching to another named user as sudo, mdo and doas do. It needs the pfexecd daemon, normally started by an SMF service, and the Solnix page names no -u option.
The manual pages
- Solnix: pfexec(1) from
pkgs.solnix.illumos-world-man· illumos.org - Linux: sudo(8) sudo-1.9.17p2 (different command, similar job)
- FreeBSD: mdo(1) 15.1-RELEASE (different command, similar job)
- OpenBSD: doas(1) 8.0 (different command, similar job)
What Solnix runs
A default Solnix system runs the illumos pfexec at /usr/bin/pfexec. No other variants are shipped. The same page also covers the profile shells pfsh, pfcsh and pfksh, which are linked to the Bourne, C and Korn shells and run commands through pfexec.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| Linux, FreeBSD, OpenBSD | authorization model | pfexec runs a command with the attributes set for the user's profiles in exec_attr(5). Profiles are searched in the user_attr(5) order and the first match wins. sudo uses the sudoers policy, doas uses /etc/doas.conf, and mdo checks for the superuser or a MAC module.Source: Solnix pfexec(1) DESCRIPTION; Linux sudo(8) DESCRIPTION; OpenBSD doas(1) EXIT STATUS; FreeBSD mdo(1) DESCRIPTION |
| Linux, FreeBSD, OpenBSD | choosing the target user | The Solnix pfexec synopsis has no option to name a target user. Its only option is -P privspec. sudo and doas take -u user, and mdo takes -u user plus -g, -G and -s for groups. Which user a command runs as is set by its profile entry.Source: Solnix pfexec(1) SYNOPSIS; Linux sudo(8) -u; OpenBSD doas(1) -u; FreeBSD mdo(1) -u |
| all four | -P meaning | On Solnix, -P privspec adds privileges awarded by the user's profiles in prof_attr(5) to the inheritable set. Only privileges in the profiles' privs keyword can be added. On Linux sudo, -P means --preserve-groups. FreeBSD mdo and OpenBSD doas have no -P.Source: Solnix pfexec(1) DESCRIPTION (pfexec -P privspec); Linux sudo(8) SYNOPSIS (-P); FreeBSD mdo(1) SYNOPSIS; OpenBSD doas(1) SYNOPSIS |
| Linux, OpenBSD | authentication | The pfexec page describes no password prompt and has no option for one. sudo may require a password and has -A, -S and -n for how it is read. doas asks for a password unless configured otherwise and has -n for non-interactive mode.Source: Solnix pfexec(1) DESCRIPTION; Linux sudo(8) -A, DESCRIPTION; OpenBSD doas(1) DESCRIPTION, -n |
| all four | daemon requirement | pfexec only works if the pfexecd daemon is running in the current zone. The page says this is normally managed by the SMF service svc:/system/pfexec:default. The sudo, mdo and doas pages in the bundle name no such daemon. Source: Solnix pfexec(1) DESCRIPTION; Linux sudo(8); FreeBSD mdo(1); OpenBSD doas(1) |
| Linux, FreeBSD, OpenBSD | configuration location | pfexec reads the exec_attr(5), prof_attr(5) and user_attr(5) databases. sudo reads /etc/sudoers or LDAP. doas reads /etc/doas.conf. mdo has no config file and relies on the superuser or mac_do(4). Solnix needs no per-command rule file.Source: Solnix pfexec(1) DESCRIPTION; Linux sudo(8) DESCRIPTION; OpenBSD doas(1) EXIT STATUS; FreeBSD mdo(1) DESCRIPTION |
| Linux, FreeBSD, OpenBSD | running without a command | The Solnix synopsis requires a command. FreeBSD mdo with no command runs the shell in SHELL, or /bin/sh. OpenBSD doas -s runs the shell from SHELL or /etc/passwd. For a shell on Solnix the page offers the profile shells pfsh, pfcsh and pfksh.Source: Solnix pfexec(1) SYNOPSIS, DESCRIPTION; FreeBSD mdo(1) DESCRIPTION; OpenBSD doas(1) -s |
| OpenBSD | exit status | pfexec documents 0 for success and 1 for an error. doas exits 0 on success and >0 on error, and lists causes such as a config parse failure, a denied command, a wrong password or a command not found. Source: Solnix pfexec(1) EXIT STATUS; OpenBSD doas(1) EXIT STATUS |
| Linux, OpenBSD | environment handling | The pfexec page does not describe how the environment is built. doas creates a new environment setting HOME, LOGNAME, PATH, SHELL, USER and umask, and sets DOAS_USER. sudo has -E to ask to preserve the environment.Source: Solnix pfexec(1) DESCRIPTION; OpenBSD doas(1) DESCRIPTION; Linux sudo(8) -E |
Everyday tasks
| Task | Solnix | Linux | FreeBSD | OpenBSD |
|---|---|---|---|---|
| run a command with elevated rights | pfexec command | sudo command | mdo command | doas command |
| run a command as a named user | — | sudo -u user command | mdo -u user command | doas -u user command |
| add profile-granted privileges | pfexec -P privspec command | — | — | — |
| start a shell with the elevated rights | pfsh, pfcsh or pfksh | sudo -s | mdo (no command) | doas -s |
| check the configuration | — | — | — | doas -C config |
Standards
- POSIX: pfexec is not a POSIX.1-2024 utility.
Writing portable scripts
- Do not assume a pfexec-style tool takes
-u. Detect which of pfexec, sudo, doas or mdo is present and write a wrapper for each. - On Solnix, the privileges a script gets depend on the user's profiles in user_attr(5) and exec_attr(5). Grant them there before relying on pfexec.
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.