diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2026-02-27 14:40:08 +0100 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2026-03-05 16:07:54 +0100 |
| commit | c11f22119a52a1f150c4929fed81fe00db2d55dc (patch) | |
| tree | bc569997cdb7c1ff5be2e8e6bc6fd91a4dcf2357 | |
| parent | 440e116cebac31cb51507b23add9d5c5cb414513 (diff) | |
| download | vyos-1x-c11f22119a52a1f150c4929fed81fe00db2d55dc.tar.gz vyos-1x-c11f22119a52a1f150c4929fed81fe00db2d55dc.zip | |
geoip: T8326: Resolve permission issue on database path
Restore required sudo on geoip op-mode
Ensures group/permission set on geoip nftables config
| -rw-r--r-- | debian/vyos-1x.postinst | 5 | ||||
| -rw-r--r-- | op-mode-definitions/geoip.xml.in | 2 | ||||
| -rw-r--r-- | python/vyos/geoip.py | 11 |
3 files changed, 13 insertions, 5 deletions
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst index 5cfc1a80e..a997ad439 100644 --- a/debian/vyos-1x.postinst +++ b/debian/vyos-1x.postinst @@ -156,6 +156,11 @@ chmod -R 775 /opt/vyatta/etc/config mkdir -p /opt/vyatta/etc/logrotate mkdir -p /opt/vyatta/etc/netdevice.d +# T8326: GeoIP permissions +mkdir -p /var/cache/vyos /usr/share/vyos-geoip +chown -R root:vyattacfg /var/cache/vyos /usr/share/vyos-geoip +chmod -R 775 /var/cache/vyos /usr/share/vyos-geoip + touch /etc/environment if [ ! -f /etc/bash_completion ]; then diff --git a/op-mode-definitions/geoip.xml.in b/op-mode-definitions/geoip.xml.in index 0fc3d8df0..eb9d65ea9 100644 --- a/op-mode-definitions/geoip.xml.in +++ b/op-mode-definitions/geoip.xml.in @@ -6,7 +6,7 @@ <properties> <help>Update GeoIP database and firewall sets</help> </properties> - <command>${vyos_libexec_dir}/geoip-update.py</command> + <command>sudo ${vyos_libexec_dir}/geoip-update.py</command> </leafNode> </children> </node> diff --git a/python/vyos/geoip.py b/python/vyos/geoip.py index 9a2b40899..619af0785 100644 --- a/python/vyos/geoip.py +++ b/python/vyos/geoip.py @@ -229,10 +229,13 @@ def geoip_update(firewall=None, policy=None): set_name = f'GEOIP_CC{vprefix}_{path[0]}_{path[1]}_{path[3]}' policy_sets[f'v{version}'][set_name] = db_return_ranges(codes, version) - render(nftables_geoip_conf, 'firewall/nftables-geoip-update.j2', { - 'firewall_sets': firewall_sets, - 'policy_sets': policy_sets - }) + render( + nftables_geoip_conf, + 'firewall/nftables-geoip-update.j2', + {'firewall_sets': firewall_sets, 'policy_sets': policy_sets}, + group='vyattacfg', + permission=0o664, + ) result = run(f'nft --file {nftables_geoip_conf}') if result != 0: |