diff options
| author | Nicolas Vandamme <n.vandamme@firis-system.lu> | 2025-09-01 17:24:26 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-09-01 17:24:26 +0200 |
| commit | a791cc3b7bb28081a6e79a988964f1fc51a47dae (patch) | |
| tree | ef5e734bf580f1abfd7d3d4ea30240d8d9fb1278 /src/opt | |
| parent | b9f60711392463af1892a30472fba6622a73390a (diff) | |
| parent | b1b4545cb7984cd3cdf42554ab2b28acd1ecb6cb (diff) | |
| download | vyos-1x-a791cc3b7bb28081a6e79a988964f1fc51a47dae.tar.gz vyos-1x-a791cc3b7bb28081a6e79a988964f1fc51a47dae.zip | |
Merge branch 'vyos:current' into current
Diffstat (limited to 'src/opt')
| -rw-r--r-- | src/opt/vyatta/etc/shell/level/users/allowed-op | 3 | ||||
| -rw-r--r-- | src/opt/vyatta/etc/shell/level/users/allowed-op.in | 3 | ||||
| -rw-r--r-- | src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run | 31 |
3 files changed, 34 insertions, 3 deletions
diff --git a/src/opt/vyatta/etc/shell/level/users/allowed-op b/src/opt/vyatta/etc/shell/level/users/allowed-op index 381fd26e5..8d4749628 100644 --- a/src/opt/vyatta/etc/shell/level/users/allowed-op +++ b/src/opt/vyatta/etc/shell/level/users/allowed-op @@ -11,7 +11,10 @@ exit force monitor ping +poweroff +reboot reset +restart release renew set diff --git a/src/opt/vyatta/etc/shell/level/users/allowed-op.in b/src/opt/vyatta/etc/shell/level/users/allowed-op.in index 9752f99a2..e01559b1c 100644 --- a/src/opt/vyatta/etc/shell/level/users/allowed-op.in +++ b/src/opt/vyatta/etc/shell/level/users/allowed-op.in @@ -7,7 +7,10 @@ exit force monitor ping +poweroff +reboot reset +restart release renew set diff --git a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run index f0479ae88..f43c85fa9 100644 --- a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run +++ b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run @@ -217,15 +217,40 @@ _vyatta_op_run () local run_cmd=$(_vyatta_op_get_node_def_field $tpath/node.def run) run_cmd=$(_vyatta_op_conv_run_cmd "$run_cmd") # convert the positional parameters local ret=0 + + if groups "$(whoami)" | grep -q -E ' vyattacfg(\s|$)'; then + # If the user is an admin, + # use sudo directly for now + op_runner="sudo" + else + # If the user is an operator, + # use the new operational command runner + # (operator users have no sudo permissions) + # and give it the original VyOS command + op_runner="vyos-op-run" + run_cmd="$@" + fi + # Exception for the `show file` command local file_cmd='\$\{vyos_op_scripts_dir\}\/file\.py' local cmd_regex="^(LESSOPEN=|less|pager|tail|(sudo )?$file_cmd).*" if [ -n "$run_cmd" ]; then eval $restore_shopts - if [[ -t 1 && "${args[1]}" == "show" && ! $run_cmd =~ $cmd_regex ]] ; then - eval "($run_cmd) | ${VYATTA_PAGER:-cat}" - else + if [[ "${args[1]}" == "configure" ]]; then + # The "configure" command modifies the shell environment + # and must run in the current shell. + eval "$run_cmd" + elif [[ "${args[1]} ${args[2]}" =~ ^set[[:space:]]+(builtin|terminal) ]]; then + # Some commands like "set terminal width" + # only affect the user shell + # (so they don't need special privileges) + # and must be executed directly in the current shell + # to be able to do their job. eval "$run_cmd" + elif [[ -t 1 && "${args[1]}" == "show" && ! $run_cmd =~ $cmd_regex ]] ; then + eval "($op_runner $run_cmd) | ${VYATTA_PAGER:-cat}" + else + eval "$op_runner $run_cmd" fi else echo -ne "\n Incomplete command: ${args[@]}\n\n" >&2 |