Merge pull request #4512 from dmbaturin/T7459-no-direct-sudo-in-op-mode

op-mode: T7459: eliminate direct use of sudo in op mode commands

2 files changed, 14 insertions, 36 deletions

diff --git a/src/helpers/vyos-sudo.py b/src/helpers/vyos-sudo.py
deleted file mode 100755
index 75dd7f29d..000000000
--- a/src/helpers/vyos-sudo.py
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-
-# Copyright 2019 VyOS maintainers and contributors <maintainers@vyos.io>
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
-
-import os
-import sys
-
-from vyos.utils.permission import is_admin
-
-
-if __name__ == '__main__':
-    if len(sys.argv) < 2:
-        print('Missing command argument')
-        sys.exit(1)
-
-    if not is_admin():
-        print('This account is not authorized to run this command')
-        sys.exit(1)
-
-    os.execvp('sudo', ['sudo'] + sys.argv[1:])
diff --git a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run
index f0479ae88..6bc77b61d 100644
--- a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run
+++ b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run
@@ -222,10 +222,21 @@ _vyatta_op_run ()
     local cmd_regex="^(LESSOPEN=|less|pager|tail|(sudo )?$file_cmd).*"
     if [ -n "$run_cmd" ]; then
       eval $restore_shopts
-      if [[ -t 1 &&  "${args[1]}" == "show" && ! $run_cmd =~ $cmd_regex ]] ; then
-        eval "($run_cmd) | ${VYATTA_PAGER:-cat}"
-      else
+      if [[ "${args[1]}" == "configure" ]]; then
+        # The "configure" command modifies the shell environment
+        # and must run in the current shell.
+        eval "$run_cmd"
+      elif [[ "${args[1]} ${args[2]}" =~ ^set[[:space:]]+(builtin|terminal) ]]; then
+        # Some commands like "set terminal width"
+        # only affect the user shell
+        # (so they don't need special privileges)
+        # and must be executed directly in the current shell
+        # to be able to do their job.
         eval "$run_cmd"
+      elif [[ -t 1 && "${args[1]}" == "show" && ! $run_cmd =~ $cmd_regex ]] ; then
+        eval "(sudo $run_cmd) | ${VYATTA_PAGER:-cat}"
+      else
+        eval "sudo $run_cmd"
       fi
     else
       echo -ne "\n  Incomplete command: ${args[@]}\n\n" >&2