diff options
| author | Daniil Baturin <daniil@baturin.org> | 2025-08-21 13:31:33 +0100 |
|---|---|---|
| committer | Daniil Baturin <daniil@baturin.org> | 2025-08-26 12:01:42 +0100 |
| commit | 00c78f33a8772b847ef6c2ee8fcbcbaf8dc87cb5 (patch) | |
| tree | fa73eea2a6d88ad252f273080741c5fef2650fca /src/opt | |
| parent | 4ad89d66634b7aa1464ae3e44bce179be48cc2bf (diff) | |
| download | vyos-1x-00c78f33a8772b847ef6c2ee8fcbcbaf8dc87cb5.tar.gz vyos-1x-00c78f33a8772b847ef6c2ee8fcbcbaf8dc87cb5.zip | |
op-mode: T7745: add a CLI for operator user command permissions
Diffstat (limited to 'src/opt')
| -rw-r--r-- | src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run index 6bc77b61d..f43c85fa9 100644 --- a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run +++ b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run @@ -217,6 +217,20 @@ _vyatta_op_run () local run_cmd=$(_vyatta_op_get_node_def_field $tpath/node.def run) run_cmd=$(_vyatta_op_conv_run_cmd "$run_cmd") # convert the positional parameters local ret=0 + + if groups "$(whoami)" | grep -q -E ' vyattacfg(\s|$)'; then + # If the user is an admin, + # use sudo directly for now + op_runner="sudo" + else + # If the user is an operator, + # use the new operational command runner + # (operator users have no sudo permissions) + # and give it the original VyOS command + op_runner="vyos-op-run" + run_cmd="$@" + fi + # Exception for the `show file` command local file_cmd='\$\{vyos_op_scripts_dir\}\/file\.py' local cmd_regex="^(LESSOPEN=|less|pager|tail|(sudo )?$file_cmd).*" @@ -234,9 +248,9 @@ _vyatta_op_run () # to be able to do their job. eval "$run_cmd" elif [[ -t 1 && "${args[1]}" == "show" && ! $run_cmd =~ $cmd_regex ]] ; then - eval "(sudo $run_cmd) | ${VYATTA_PAGER:-cat}" + eval "($op_runner $run_cmd) | ${VYATTA_PAGER:-cat}" else - eval "sudo $run_cmd" + eval "$op_runner $run_cmd" fi else echo -ne "\n Incomplete command: ${args[@]}\n\n" >&2 |