From 00c78f33a8772b847ef6c2ee8fcbcbaf8dc87cb5 Mon Sep 17 00:00:00 2001
From: Daniil Baturin <daniil@baturin.org>
Date: Thu, 21 Aug 2025 13:31:33 +0100
Subject: op-mode: T7745: add a CLI for operator user command permissions

---
 .../vyatta-op/functions/interpreter/vyatta-op-run      | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

(limited to 'src/opt')

diff --git a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run
index 6bc77b61d..f43c85fa9 100644
--- a/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run
+++ b/src/opt/vyatta/share/vyatta-op/functions/interpreter/vyatta-op-run
@@ -217,6 +217,20 @@ _vyatta_op_run ()
     local run_cmd=$(_vyatta_op_get_node_def_field $tpath/node.def run)
     run_cmd=$(_vyatta_op_conv_run_cmd "$run_cmd") # convert the positional parameters
     local ret=0
+
+    if groups "$(whoami)" | grep -q -E ' vyattacfg(\s|$)'; then
+      # If the user is an admin,
+      # use sudo directly for now
+      op_runner="sudo"
+    else
+      # If the user is an operator,
+      # use the new operational command runner
+      # (operator users have no sudo permissions)
+      # and give it the original VyOS command
+      op_runner="vyos-op-run"
+      run_cmd="$@"
+    fi
+
     # Exception for the `show file` command
     local file_cmd='\$\{vyos_op_scripts_dir\}\/file\.py'
     local cmd_regex="^(LESSOPEN=|less|pager|tail|(sudo )?$file_cmd).*"
@@ -234,9 +248,9 @@ _vyatta_op_run ()
         # to be able to do their job.
         eval "$run_cmd"
       elif [[ -t 1 && "${args[1]}" == "show" && ! $run_cmd =~ $cmd_regex ]] ; then
-        eval "(sudo $run_cmd) | ${VYATTA_PAGER:-cat}"
+        eval "($op_runner $run_cmd) | ${VYATTA_PAGER:-cat}"
       else
-        eval "sudo $run_cmd"
+        eval "$op_runner $run_cmd"
       fi
     else
       echo -ne "\n  Incomplete command: ${args[@]}\n\n" >&2
-- 
cgit v1.2.3