peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

sysrepo: allow non-wheel users access to sysrepo data

Browse Source 
Non-privileged users in the sys-cli group can now access sysrepo data.

The data is now solely protected by the NCAM rules and not Unix file
permissions. Any stray user that's not part of the (default) sys-cli
group still can't access syrepo, like users added from the shell.

Fixes #932

Signed-off-by: Richard Alpe <richard@bit42.se>
This commit is contained in:
Richard Alpe
2025-04-28 15:41:09 +02:00
parent 399984082f
commit ac89f94580
8 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/aarch64_defconfig
+1
View File
@@ -34,6 +34,7 @@ BR2_LINUX_KERNEL_INSTALL_TARGET=y
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_DBUS_CXX=y
configs/aarch64_minimal_defconfig
+1
View File
@@ -34,6 +34,7 @@ BR2_LINUX_KERNEL_INSTALL_TARGET=y
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_DBUS_CXX=y
configs/r2s_defconfig
+1
View File
@@ -41,6 +41,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_LINUX_FIRMWARE=y
configs/riscv64_defconfig
+1
View File
@@ -39,6 +39,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_LINUX_FIRMWARE=y
configs/x86_64_defconfig
+1
View File
@@ -34,6 +34,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_DBUS_CXX=y
configs/x86_64_minimal_defconfig
+1
View File
@@ -35,6 +35,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_DBUS_CXX=y
package/confd/confd.mk
+3 -2
View File
@@ -71,9 +71,10 @@ endef
endif
define CONFD_PERMISSIONS
/etc/sysrepo/data/ r 660 root wheel - - - - -
/etc/sysrepo/data d 770 root wheel - - - - -
/etc/sysrepo/data/ r 660 root sys-cli - - - - -
/etc/sysrepo/data d 770 root sys-cli - - - - -
endef
define CONFD_EMPTY_SYSREPO
rm -rf $(TARGET_DIR)/etc/sysrepo/data/
endef
src/confd/bin/load
-3
View File
@@ -82,9 +82,6 @@ else
fi
fi
# Ensure users in admin group can access all datastores
chgrp wheel /dev/shm/*
if [ ! -f "$fn" ]; then
case "$config" in
startup-config)