diff options
| author | Daniil Baturin <daniil@vyos.io> | 2025-08-28 15:26:19 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-08-28 15:26:19 +0100 |
| commit | 133cb0c65d5aa2ca5a96feba6ab7adc3a8f1de58 (patch) | |
| tree | f395cec0aa9448a3b5d40eeeff361603f1d9b117 /src/opt | |
| parent | d30039526bdd718f100a0f62986fb1e139d424f4 (diff) | |
| parent | 021725628c5b6bdb00d9e853c649156813c17e57 (diff) | |
| download | vyos-1x-133cb0c65d5aa2ca5a96feba6ab7adc3a8f1de58.tar.gz vyos-1x-133cb0c65d5aa2ca5a96feba6ab7adc3a8f1de58.zip | |
Merge pull request #4674 from dmbaturin/op-mode-permissions
op-mode: T7745: add a CLI for operator user command permissions
Diffstat (limited to 'src/opt')
| -rw-r--r-- | src/opt/vyatta/etc/shell/level/users/allowed-op | 3 | ||||
| -rw-r--r-- | src/opt/vyatta/etc/shell/level/users/allowed-op.in | 3 | ||||
| -rw-r--r-- | src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run | 18 |
3 files changed, 22 insertions, 2 deletions
diff --git a/src/opt/vyatta/etc/shell/level/users/allowed-op b/src/opt/vyatta/etc/shell/level/users/allowed-op index 381fd26e5..8d4749628 100644 --- a/src/opt/vyatta/etc/shell/level/users/allowed-op +++ b/src/opt/vyatta/etc/shell/level/users/allowed-op @@ -11,7 +11,10 @@ exit force monitor ping +poweroff +reboot reset +restart release renew set diff --git a/src/opt/vyatta/etc/shell/level/users/allowed-op.in b/src/opt/vyatta/etc/shell/level/users/allowed-op.in index 9752f99a2..e01559b1c 100644 --- a/src/opt/vyatta/etc/shell/level/users/allowed-op.in +++ b/src/opt/vyatta/etc/shell/level/users/allowed-op.in @@ -7,7 +7,10 @@ exit force monitor ping +poweroff +reboot reset +restart release renew set diff --git a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run index 6bc77b61d..f43c85fa9 100644 --- a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run +++ b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run @@ -217,6 +217,20 @@ _vyatta_op_run () local run_cmd=$(_vyatta_op_get_node_def_field $tpath/node.def run) run_cmd=$(_vyatta_op_conv_run_cmd "$run_cmd") # convert the positional parameters local ret=0 + + if groups "$(whoami)" | grep -q -E ' vyattacfg(\s|$)'; then + # If the user is an admin, + # use sudo directly for now + op_runner="sudo" + else + # If the user is an operator, + # use the new operational command runner + # (operator users have no sudo permissions) + # and give it the original VyOS command + op_runner="vyos-op-run" + run_cmd="$@" + fi + # Exception for the `show file` command local file_cmd='\$\{vyos_op_scripts_dir\}\/file\.py' local cmd_regex="^(LESSOPEN=|less|pager|tail|(sudo )?$file_cmd).*" @@ -234,9 +248,9 @@ _vyatta_op_run () # to be able to do their job. eval "$run_cmd" elif [[ -t 1 && "${args[1]}" == "show" && ! $run_cmd =~ $cmd_regex ]] ; then - eval "(sudo $run_cmd) | ${VYATTA_PAGER:-cat}" + eval "($op_runner $run_cmd) | ${VYATTA_PAGER:-cat}" else - eval "sudo $run_cmd" + eval "$op_runner $run_cmd" fi else echo -ne "\n Incomplete command: ${args[@]}\n\n" >&2 |