diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-03-05 16:36:11 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-03-05 16:36:11 +0100 |
| commit | 7c520f8ec786f6cff411188498822eab00e69afd (patch) | |
| tree | ca270d2011999fe34c93f350b5f8bab116f24f1a | |
| parent | 5ea47f5c7dab6cee38aef355fd78d434a10dd463 (diff) | |
| parent | c11f22119a52a1f150c4929fed81fe00db2d55dc (diff) | |
| download | vyos-1x-7c520f8ec786f6cff411188498822eab00e69afd.tar.gz vyos-1x-7c520f8ec786f6cff411188498822eab00e69afd.zip | |
Merge pull request #5027 from sarthurdev/T8326
geoip: T8326: Resolve permission issue on database paths
| -rw-r--r-- | debian/vyos-1x.postinst | 5 | ||||
| -rw-r--r-- | op-mode-definitions/geoip.xml.in | 2 | ||||
| -rw-r--r-- | python/vyos/geoip.py | 11 |
3 files changed, 13 insertions, 5 deletions
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst index 5cfc1a80e..a997ad439 100644 --- a/debian/vyos-1x.postinst +++ b/debian/vyos-1x.postinst @@ -156,6 +156,11 @@ chmod -R 775 /opt/vyatta/etc/config mkdir -p /opt/vyatta/etc/logrotate mkdir -p /opt/vyatta/etc/netdevice.d +# T8326: GeoIP permissions +mkdir -p /var/cache/vyos /usr/share/vyos-geoip +chown -R root:vyattacfg /var/cache/vyos /usr/share/vyos-geoip +chmod -R 775 /var/cache/vyos /usr/share/vyos-geoip + touch /etc/environment if [ ! -f /etc/bash_completion ]; then diff --git a/op-mode-definitions/geoip.xml.in b/op-mode-definitions/geoip.xml.in index 0fc3d8df0..eb9d65ea9 100644 --- a/op-mode-definitions/geoip.xml.in +++ b/op-mode-definitions/geoip.xml.in @@ -6,7 +6,7 @@ <properties> <help>Update GeoIP database and firewall sets</help> </properties> - <command>${vyos_libexec_dir}/geoip-update.py</command> + <command>sudo ${vyos_libexec_dir}/geoip-update.py</command> </leafNode> </children> </node> diff --git a/python/vyos/geoip.py b/python/vyos/geoip.py index 9a2b40899..619af0785 100644 --- a/python/vyos/geoip.py +++ b/python/vyos/geoip.py @@ -229,10 +229,13 @@ def geoip_update(firewall=None, policy=None): set_name = f'GEOIP_CC{vprefix}_{path[0]}_{path[1]}_{path[3]}' policy_sets[f'v{version}'][set_name] = db_return_ranges(codes, version) - render(nftables_geoip_conf, 'firewall/nftables-geoip-update.j2', { - 'firewall_sets': firewall_sets, - 'policy_sets': policy_sets - }) + render( + nftables_geoip_conf, + 'firewall/nftables-geoip-update.j2', + {'firewall_sets': firewall_sets, 'policy_sets': policy_sets}, + group='vyattacfg', + permission=0o664, + ) result = run(f'nft --file {nftables_geoip_conf}') if result != 0: |