From c11f22119a52a1f150c4929fed81fe00db2d55dc Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Fri, 27 Feb 2026 14:40:08 +0100
Subject: geoip: T8326: Resolve permission issue on database path

Restore required sudo on geoip op-mode
Ensures group/permission set on geoip nftables config
---
 python/vyos/geoip.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'python')

diff --git a/python/vyos/geoip.py b/python/vyos/geoip.py
index 9a2b40899..619af0785 100644
--- a/python/vyos/geoip.py
+++ b/python/vyos/geoip.py
@@ -229,10 +229,13 @@ def geoip_update(firewall=None, policy=None):
                 set_name = f'GEOIP_CC{vprefix}_{path[0]}_{path[1]}_{path[3]}'
                 policy_sets[f'v{version}'][set_name] = db_return_ranges(codes, version)
 
-        render(nftables_geoip_conf, 'firewall/nftables-geoip-update.j2', {
-            'firewall_sets': firewall_sets,
-            'policy_sets': policy_sets
-        })
+        render(
+            nftables_geoip_conf,
+            'firewall/nftables-geoip-update.j2',
+            {'firewall_sets': firewall_sets, 'policy_sets': policy_sets},
+            group='vyattacfg',
+            permission=0o664,
+        )
 
         result = run(f'nft --file {nftables_geoip_conf}')
         if result != 0:
-- 
cgit v1.2.3