peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

sys: rename sys-cli -> sysrepo + klish

Browse Source 
Previously the sys-cli group was for interactive shell access, but with
ever changing requirements this split has become necessary.

This commit introduces the 'sysrepo' group for low-level access to all
sysrepo commands, i.e., bootstrap only.  For user-level shell access a
'klish' group is added which allows users to connect to the CLI.  This
is now the only group users, including the default 'admin', are members
of, effectively making the new 'copy' tool the norm.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2026-01-22 22:44:14 +01:00
parent 7559f4be83
commit b58550367c
16 changed files with 24 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/aarch32_defconfig
+1 -1
View File
@@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y
BR2_PACKAGE_LIBCURL_CURL=y
BR2_PACKAGE_NETOPEER2_CLI=y
BR2_PACKAGE_NSS_MDNS=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
BR2_PACKAGE_LINUX_PAM=y
BR2_PACKAGE_ONIGURUMA=y
BR2_PACKAGE_AVAHI_DAEMON=y
configs/aarch32_minimal_defconfig
+1 -1
View File
@@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y
BR2_PACKAGE_LIBCURL_CURL=y
BR2_PACKAGE_NETOPEER2_CLI=y
BR2_PACKAGE_NSS_MDNS=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
BR2_PACKAGE_LINUX_PAM=y
BR2_PACKAGE_ONIGURUMA=y
BR2_PACKAGE_AVAHI_DAEMON=y
configs/aarch64_defconfig
+1 -1
View File
@@ -63,7 +63,7 @@ BR2_PACKAGE_LIBINPUT=y
BR2_PACKAGE_LIBCURL_CURL=y
BR2_PACKAGE_NETOPEER2_CLI=y
BR2_PACKAGE_NSS_MDNS=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
BR2_PACKAGE_LINUX_PAM=y
BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
BR2_PACKAGE_ONIGURUMA=y
configs/aarch64_minimal_defconfig
+1 -1
View File
@@ -34,7 +34,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc
BR2_PACKAGE_ODHCP6C=y
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_DBUS_CXX=y
configs/riscv64_defconfig
+1 -1
View File
@@ -76,7 +76,7 @@ BR2_PACKAGE_LIBINPUT=y
BR2_PACKAGE_LIBCURL_CURL=y
BR2_PACKAGE_NETOPEER2_CLI=y
BR2_PACKAGE_NSS_MDNS=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
BR2_PACKAGE_LINUX_PAM=y
BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
BR2_PACKAGE_ONIGURUMA=y
configs/x86_64_defconfig
+1 -1
View File
@@ -59,7 +59,7 @@ BR2_PACKAGE_LIBOPENSSL_BIN=y
BR2_PACKAGE_LIBCURL_CURL=y
BR2_PACKAGE_NETOPEER2_CLI=y
BR2_PACKAGE_NSS_MDNS=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
BR2_PACKAGE_LINUX_PAM=y
BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
BR2_PACKAGE_ONIGURUMA=y
configs/x86_64_minimal_defconfig
+1 -1
View File
@@ -35,7 +35,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc
BR2_PACKAGE_ODHCP6C=y
BR2_PACKAGE_STRACE=y
BR2_PACKAGE_STRESS_NG=y
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
BR2_PACKAGE_JQ=y
BR2_PACKAGE_E2FSPROGS=y
BR2_PACKAGE_DBUS_CXX=y
package/confd-test-mode/confd-test-mode.mk
+2 -2
View File
@@ -26,8 +26,8 @@ define CONFD_TEST_MODE_INSTALL_YANG_MODULES
$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc
endef
define CONFD_TEST_MODE_PERMISSIONS
/etc/sysrepo/data/ r 660 root wheel - - - - -
/etc/sysrepo/data d 770 root wheel - - - - -
/etc/sysrepo/data/ r 660 root sysrepo - - - - -
/etc/sysrepo/data d 770 root sysrepo - - - - -
endef
define CONFD_TEST_MODE_CLEANUP
rm -f /dev/shm/$(CONFD_TEST_MODE_SYSREPO_SHM_PREFIX)*
package/klish/klishd.conf
+2 -3
View File
@@ -8,6 +8,5 @@ UnixSocketPath=/run/klishd.sock
DBs=libxml2
# The group to set on the UNIX socket. By default, the socket retains the group
# of the user starting the daemon. The upstream sysrepo project recommends using
# the 'sysrepo' group to allow access to CLI tools.
SocketGroup=sysrepo
# of the user starting the daemon.
SocketGroup=klish
package/skeleton-init-finit/skeleton/etc/group
+2 -1
View File
@@ -20,7 +20,8 @@ backup:x:34:
utmp:x:43:
plugdev:x:46:
lock:x:54:
sys-cli:x:60:
sysrepo:x:60:
klish:x:70:
netdev:x:82:
users:x:100:
nobody:x:65534:
package/skeleton-init-finit/skeleton/etc/passwd
+2 -1
View File
@@ -6,5 +6,6 @@ sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
backup:x:34:34:backup:/var/backups:/bin/false
sys-cli:x:60:60:CLI capability:/var:/bin/false
sysrepo:x:60:60:sysrepo:/var:/bin/false
klish:x:70:70:CLI capability:/var:/bin/false
nobody:x:65534:65534:nobody:/home:/bin/false
package/skeleton-init-finit/skeleton/etc/shadow
+2 -1
View File
@@ -5,6 +5,7 @@ sys:*:::::::
sync:*:::::::
mail:*:::::::
www-data:*:::::::
sys-cli:*:::::::
sysrepo:*:::::::
klish:*:::::::
backup:*:::::::
nobody:*:::::::
src/confd/src/system.c
+3 -3
View File
@@ -558,9 +558,9 @@ static void del_groups(const char *user, const char **groups)
static void adjust_access(const char *user, const char *shell)
{
if (strcmp(shell, "/bin/false"))
add_group(user, "sys-cli");
add_group(user, "klish");
else
del_group(user, "sys-cli");
del_group(user, "klish");
}
/* XXX: Currently Infix only has admin and non-admins as a group */
@@ -615,7 +615,7 @@ static int is_valid_username(const char *user)
return 1;
}
static char *sys_find_usable_shell(sr_session_ctx_t *sess, char *name)
static char *sys_find_usable_shell(sr_session_ctx_t *sess, const char *name)
{
const char *conf = NULL;
char *shell = NULL;
test/case/misc/start_from_startup/Readme.adoc
+1 -1
View File
@@ -19,7 +19,7 @@ endif::topdoc[]
. Configure
. Reboot and wait for the unit to come back
. Verify user admin is now in wheel group
. Verify user admin is now in sys-cli group
. Verify user admin is now in sysrepo group
<<<
test/case/misc/start_from_startup/test.py
+2 -2
View File
@@ -24,8 +24,8 @@ with infamy.Test() as test:
if not tgtssh.runsh("grep wheel /etc/group | grep 'admin'"):
test.fail()
with test.step("Verify user admin is now in sys-cli group"):
if not tgtssh.runsh("grep sys-cli /etc/group | grep 'admin'"):
with test.step("Verify user admin is now in sysrepo group"):
if not tgtssh.runsh("grep sysrepo /etc/group | grep 'admin'"):
test.fail()
test.succeed()
test/case/statd/system/system/run/getent_shadow
+1 -1
View File
@@ -5,7 +5,7 @@ sys:*:::::::
sync:*:::::::
mail:*:::::::
www-data:*:::::::
sys-cli:*:::::::
sysrepo:*:::::::
backup:*:::::::
nobody:*:::::::
yangnobody:*:::::::