From 6752ff4d2f736b59b1a7b9e05537854b317c6ef6 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Thu, 5 Sep 2024 06:46:53 +0200 Subject: [PATCH] cli: regression in ospf show commands With the recent changes in Infix v24.08 to tighten up permissions, a regression in the 'show ospf' family of commands was introduced. This patch adds a 'doas' prefix to all vtysh commands. The 'doas' tool wraps sudo in a way such than unauthorized users do not get a sudo error thrown as result. A better fix might be to either include all admin group users also in the UNIX group 'frrvty', or even better, change the default group of vtysh to 'wheel'. Affected files are /etc/frr/vtysh.conf and all /run/frr/*.vty sockets, the latter are created at runtime by zebra, ospfd, etc. This require modifying the buildroot/package/frr/frr.mk file, which unfortunately have the group hard coded. admin@R2:~$ ls -l /etc/frr/vtysh.conf -rw-r----- 1 frr frrvty 32 Sep 3 05:27 /etc/frr/vtysh.conf admin@R2:~$ ls -l /run/frr/*.vty srwxrwx--- 1 frr frrvty 0 Sep 5 04:37 /run/frr/ospfd.vty srwxrwx--- 1 frr frrvty 0 Sep 5 04:37 /run/frr/zebra.vty Fixes #601 Signed-off-by: Joachim Wiberg --- src/klish-plugin-infix/xml/infix.xml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/klish-plugin-infix/xml/infix.xml b/src/klish-plugin-infix/xml/infix.xml index ad0ca02c..8a12c813 100644 --- a/src/klish-plugin-infix/xml/infix.xml +++ b/src/klish-plugin-infix/xml/infix.xml @@ -307,17 +307,17 @@ if [ -z "$KLISH_PARAM_name" ]; then - vtysh -c "show ip ospf" + doas vtysh -c "show ip ospf" elif [ "$KLISH_PARAM_name" == "neighbor" ];then - vtysh -c "show ip ospf neighbor" + doas vtysh -c "show ip ospf neighbor" elif [ "$KLISH_PARAM_name" == "interfaces" ];then - vtysh -c "show ip ospf interface" + doas vtysh -c "show ip ospf interface" elif [ "$KLISH_PARAM_name" == "routes" ];then - vtysh -c "show ip ospf route" + doas vtysh -c "show ip ospf route" elif [ "$KLISH_PARAM_name" == "database" ];then - vtysh -c "show ip ospf database" + doas vtysh -c "show ip ospf database" elif [ "$KLISH_PARAM_name" == "bfd" ];then - vtysh -c "show bfd peers" + doas vtysh -c "show bfd peers" fi