Generate unpriviledged allowed-op at compile time. Add script to allow admin user to regenerate it if needed. Fix ambiguous command message.

6 files changed, 66 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
index 8182259..e1bffc4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,7 @@ libtool
 /INSTALL
 /Makefile.in
 /Makefile
+/etc/shell/level/users/allowed-op
 
 /src/render_xml
 
diff --git a/Makefile.am b/Makefile.am
index 0cc0758..d1f98ff 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -4,6 +4,7 @@ completiondir	 = /etc/bash_completion.d
 completion_DATA	 = etc/bash_completion.d/vyatta-op
 opdir		 = $(datadir)/vyatta-op/templates
 bin_sudo_usersdir = $(bindir)/sudo-users
+etc_shell_leveldir = $(sysconfdir)/shell/level
 
 funcdir		 = $(datadir)/vyatta-op/functions
 func_DATA	 = functions/tech-support
@@ -11,9 +12,11 @@ func_DATA	+= functions/tech-support-brief
 
 interpdir = $(datadir)/vyatta-op/functions/interpreter
 interp_DATA = functions/interpreter/vyatta-op-run
+interp_DATA += functions/interpreter/vyatta-unpriv
 interp_DATA += functions/interpreter/vyatta-common
 interp_DATA += functions/interpreter/vyatta-image-complete
 
+
 bin_SCRIPTS	 = scripts/vyatta-show-interfaces
 bin_SCRIPTS	+= scripts/vyatta-show-interfaces.pl
 bin_SCRIPTS	+= scripts/vyatta-show-version
@@ -39,6 +42,7 @@ bin_SCRIPTS	+= scripts/vyatta-op-cmd-wrapper
 
 sbin_SCRIPTS     = scripts/dhcpv6-client-show-leases.pl
 sbin_SCRIPTS    += scripts/vyatta-image-tools.pl
+sbin_SCRIPTS    += scripts/vyatta-regen-unpriv-commands.sh
 
 bin_sudo_users_SCRIPTS      = scripts/vyatta-identify-interface.pl
 bin_sudo_users_SCRIPTS     += scripts/vyatta-delete-log-file.sh
@@ -47,9 +51,14 @@ bin_sudo_users_SCRIPTS     += scripts/vyatta-op-dns-forwarding.pl
 bin_sudo_users_SCRIPTS     += scripts/vyatta-op-dynamic-dns.pl
 bin_sudo_users_SCRIPTS     += scripts/vyatta-clear-conntrack
 
+all-local:
+	./gen-unpriv-commands.sh
+
 cpiop = find  . ! -regex '\(.*~\|.*\.bak\|.*\.swp\|.*\#.*\#\)' -print0 | \
 	cpio -0pd
 
 install-exec-hook:
 	mkdir -p $(DESTDIR)$(opdir)
 	cd templates; $(cpiop) $(DESTDIR)$(opdir)
+	mkdir -p $(DESTDIR)$(etc_shell_leveldir)
+	cd etc/shell/level; $(cpiop) $(DESTDIR)$(etc_shell_leveldir)
diff --git a/etc/shell/level/users/allowed-op.in b/etc/shell/level/users/allowed-op.in
new file mode 100644
index 0000000..a45a92f
--- /dev/null
+++ b/etc/shell/level/users/allowed-op.in
@@ -0,0 +1,20 @@
+clear
+connect
+debug
+delete
+disconnect
+exit
+force
+no
+ping
+ping6
+release
+renew
+set
+show
+telnet
+terminal
+traceroute
+traceroute6
+undebug
+update
diff --git a/functions/interpreter/vyatta-unpriv b/functions/interpreter/vyatta-unpriv
index 0b07317..ea1e952 100644
--- a/functions/interpreter/vyatta-unpriv
+++ b/functions/interpreter/vyatta-unpriv
@@ -13,6 +13,7 @@ vyatta_unpriv_ambiguous ()
   get_prefix_filtered_list $1 op_allowed filtered_cmds
   _vyatta_op_node_path=${vyatta_op_templates}
   comps=$(_vyatta_op_help $1 ${filtered_cmds[@]})
+  echo -ne "\n  Ambiguous command: [$1]\n"
   echo -e "$comps\n" | sed -e 's/^P/  P/'
 }
 
diff --git a/gen-unpriv-commands.sh b/gen-unpriv-commands.sh
new file mode 100755
index 0000000..cce36a1
--- /dev/null
+++ b/gen-unpriv-commands.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+source ./functions/interpreter/vyatta-common
+
+declare -a op_allowed
+declare -a toplevel
+
+op_allowed=( $(cat ./etc/shell/level/users/allowed-op.in) )
+toplevel=( $(ls ./templates/) )
+
+vyatta_unpriv_gen_allowed () {
+  local -a allowed_cmds=()
+  rm -f ./etc/shell/level/users/allowed-op
+  for cmd in "${op_allowed[@]}"; do
+    if is_elem_of ${cmd} toplevel; then
+      for pos in $(seq 1 ${#cmd}); do
+         case ${cmd:0:$pos} in
+            for|do|done|if|fi|case|while|tr )
+              continue ;;
+            *) ;;
+          esac
+      if ! is_elem_of ${cmd:0:$pos} allowed_cmds; then
+        allowed_cmds+=( ${cmd:0:$pos} )
+        echo ${cmd:0:$pos} >> ./etc/shell/level/users/allowed-op
+      fi
+      done
+    else
+      echo ${cmd} >> ./etc/shell/level/users/allowed-op
+    fi
+  done
+}
+
+vyatta_unpriv_gen_allowed
diff --git a/scripts/vyatta-regen-unpriv-commands.sh b/scripts/vyatta-regen-unpriv-commands.sh
new file mode 100644
index 0000000..e6f7e2f
--- /dev/null
+++ b/scripts/vyatta-regen-unpriv-commands.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+source /opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-unpriv
+vyatta_unpriv_gen_allowed