peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-29 20:23:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

cli: regression in ospf show commands

Browse Source 
With the recent changes in Infix v24.08 to tighten up permissions, a
regression in the 'show ospf' family of commands was introduced.

This patch adds a 'doas' prefix to all vtysh commands.  The 'doas' tool
wraps sudo in a way such than unauthorized users do not get a sudo error
thrown as result.

A better fix might be to either include all admin group users also in
the UNIX group 'frrvty', or even better, change the default group of
vtysh to 'wheel'.  Affected files are /etc/frr/vtysh.conf and all
/run/frr/*.vty sockets, the latter are created at runtime by zebra,
ospfd, etc.  This require modifying the buildroot/package/frr/frr.mk
file, which unfortunately have the group hard coded.

    admin@R2:~$ ls -l /etc/frr/vtysh.conf
    -rw-r-----    1 frr      frrvty    32 Sep  3 05:27 /etc/frr/vtysh.conf

    admin@R2:~$ ls -l /run/frr/*.vty
    srwxrwx---    1 frr      frrvty     0 Sep  5 04:37 /run/frr/ospfd.vty
    srwxrwx---    1 frr      frrvty     0 Sep  5 04:37 /run/frr/zebra.vty

Fixes #601

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2024-09-05 10:38:06 +02:00
parent d856fc8dbc
commit 6752ff4d2f
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/klish-plugin-infix/xml/infix.xml
+6 -6
View File
@@ -307,17 +307,17 @@
</PARAM>
<ACTION sym="script">
if [ -z "$KLISH_PARAM_name" ]; then
vtysh -c "show ip ospf"
doas vtysh -c "show ip ospf"
elif [ "$KLISH_PARAM_name" == "neighbor" ];then
vtysh -c "show ip ospf neighbor"
doas vtysh -c "show ip ospf neighbor"
elif [ "$KLISH_PARAM_name" == "interfaces" ];then
vtysh -c "show ip ospf interface"
doas vtysh -c "show ip ospf interface"
elif [ "$KLISH_PARAM_name" == "routes" ];then
vtysh -c "show ip ospf route"
doas vtysh -c "show ip ospf route"
elif [ "$KLISH_PARAM_name" == "database" ];then
vtysh -c "show ip ospf database"
doas vtysh -c "show ip ospf database"
elif [ "$KLISH_PARAM_name" == "bfd" ];then
vtysh -c "show bfd peers"
doas vtysh -c "show bfd peers"
fi
</ACTION>
</COMMAND>