peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-31 21:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #946 from kernelkit/admin-vtysh-privs

Browse Source 
confd: ensure admin users have full access to vtysh

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2025-02-22 10:15:22 +01:00
committed by GitHub
parent d82b3e51ea 83797ca19c
commit 51987948ad
1 changed files with 24 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/confd/src/ietf-system.c
+24 -8
View File
@@ -45,6 +45,13 @@ static char *os = NULL;
static char *nm = NULL;
static char *id = NULL;
/* TODO: add `#ifdef HAVE_FOO` around optional features. */
static const char *admin_groups[] = {
"wheel",
"frrvty",
NULL
};
static struct { char *name, *shell; } shells[] = {
{ "infix-system:sh", "/bin/sh" },
{ "infix-system:bash", "/bin/bash" },
@@ -601,8 +608,7 @@ fail:
static bool is_group_member(const char *user, const char *group)
{
/* Check if user is already in group */
if (!systemf("grep %s /etc/group |grep -q %s", group, user))
if (!systemf("grep '^%s:' /etc/group |grep -q %s", group, user))
return true;
return false;
@@ -610,10 +616,8 @@ static bool is_group_member(const char *user, const char *group)
static void add_group(const char *user, const char *group)
{
bool is_already = is_group_member(user, group);
if (is_already)
return; /* already group member */
if (is_group_member(user, group))
return;
if (systemf("adduser %s %s", user, group))
AUDIT("Failed giving user \"%s\" UNIX %s permissions.", user, group);
@@ -621,6 +625,12 @@ static void add_group(const char *user, const char *group)
AUDIT("User \"%s\" added to UNIX \"%s\" group.", user, group);
}
static void add_groups(const char *user, const char **groups)
{
for (size_t i = 0; groups[i]; i++)
add_group(user, groups[i]);
}
static void del_group(const char *user, const char *group)
{
bool is_already = is_group_member(user, group);
@@ -634,6 +644,12 @@ static void del_group(const char *user, const char *group)
AUDIT("User \"%s\" removed from UNIX \"%s\" group.", user, group);
}
static void del_groups(const char *user, const char **groups)
{
for (size_t i = 0; groups[i]; i++)
del_group(user, groups[i]);
}
/* Users with a valid shell are also allowed CLI access */
static void adjust_access(const char *user, const char *shell)
{
@@ -1446,9 +1462,9 @@ static int change_nacm(sr_session_ctx_t *session, uint32_t sub_id, const char *m
AUDIT("Failed adjusting shell for user \"%s\"", user);
if (is_admin)
add_group(user, "wheel");
add_groups(user, admin_groups);
else
del_group(user, "wheel");
del_groups(user, admin_groups);
}
cleanup: