diff --git a/configs/aarch32_defconfig b/configs/aarch32_defconfig index 89c943f7..a33c38e1 100644 --- a/configs/aarch32_defconfig +++ b/configs/aarch32_defconfig @@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_ONIGURUMA=y BR2_PACKAGE_AVAHI_DAEMON=y diff --git a/configs/aarch32_minimal_defconfig b/configs/aarch32_minimal_defconfig index 4e5a8645..9aae459a 100644 --- a/configs/aarch32_minimal_defconfig +++ b/configs/aarch32_minimal_defconfig @@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_ONIGURUMA=y BR2_PACKAGE_AVAHI_DAEMON=y diff --git a/configs/aarch64_defconfig b/configs/aarch64_defconfig index 0d7d02c1..da687377 100644 --- a/configs/aarch64_defconfig +++ b/configs/aarch64_defconfig @@ -63,7 +63,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y BR2_PACKAGE_ONIGURUMA=y diff --git a/configs/aarch64_minimal_defconfig b/configs/aarch64_minimal_defconfig index 1c7d00b7..34262285 100644 --- a/configs/aarch64_minimal_defconfig +++ b/configs/aarch64_minimal_defconfig @@ -34,7 +34,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc BR2_PACKAGE_ODHCP6C=y BR2_PACKAGE_STRACE=y BR2_PACKAGE_STRESS_NG=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_JQ=y BR2_PACKAGE_E2FSPROGS=y BR2_PACKAGE_DBUS_CXX=y diff --git a/configs/riscv64_defconfig b/configs/riscv64_defconfig index 660c0f42..30ddff4b 100644 --- a/configs/riscv64_defconfig +++ b/configs/riscv64_defconfig @@ -76,7 +76,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y BR2_PACKAGE_ONIGURUMA=y diff --git a/configs/x86_64_defconfig b/configs/x86_64_defconfig index 8ca1610f..ad451694 100644 --- a/configs/x86_64_defconfig +++ b/configs/x86_64_defconfig @@ -59,7 +59,7 @@ BR2_PACKAGE_LIBOPENSSL_BIN=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y BR2_PACKAGE_ONIGURUMA=y diff --git a/configs/x86_64_minimal_defconfig b/configs/x86_64_minimal_defconfig index b50fed2e..3b9ce6c4 100644 --- a/configs/x86_64_minimal_defconfig +++ b/configs/x86_64_minimal_defconfig @@ -35,7 +35,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc BR2_PACKAGE_ODHCP6C=y BR2_PACKAGE_STRACE=y BR2_PACKAGE_STRESS_NG=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_JQ=y BR2_PACKAGE_E2FSPROGS=y BR2_PACKAGE_DBUS_CXX=y diff --git a/package/confd-test-mode/confd-test-mode.mk b/package/confd-test-mode/confd-test-mode.mk index aa144ed8..1a9f040c 100644 --- a/package/confd-test-mode/confd-test-mode.mk +++ b/package/confd-test-mode/confd-test-mode.mk @@ -26,8 +26,8 @@ define CONFD_TEST_MODE_INSTALL_YANG_MODULES $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc endef define CONFD_TEST_MODE_PERMISSIONS - /etc/sysrepo/data/ r 660 root wheel - - - - - - /etc/sysrepo/data d 770 root wheel - - - - - + /etc/sysrepo/data/ r 660 root sysrepo - - - - - + /etc/sysrepo/data d 770 root sysrepo - - - - - endef define CONFD_TEST_MODE_CLEANUP rm -f /dev/shm/$(CONFD_TEST_MODE_SYSREPO_SHM_PREFIX)* diff --git a/package/klish/klishd.conf b/package/klish/klishd.conf index ccc5d0d9..b6e538fc 100644 --- a/package/klish/klishd.conf +++ b/package/klish/klishd.conf @@ -8,6 +8,5 @@ UnixSocketPath=/run/klishd.sock DBs=libxml2 # The group to set on the UNIX socket. By default, the socket retains the group -# of the user starting the daemon. The upstream sysrepo project recommends using -# the 'sysrepo' group to allow access to CLI tools. -SocketGroup=sysrepo +# of the user starting the daemon. +SocketGroup=klish diff --git a/package/skeleton-init-finit/skeleton/etc/group b/package/skeleton-init-finit/skeleton/etc/group index 2614592d..fccad8ec 100644 --- a/package/skeleton-init-finit/skeleton/etc/group +++ b/package/skeleton-init-finit/skeleton/etc/group @@ -20,7 +20,8 @@ backup:x:34: utmp:x:43: plugdev:x:46: lock:x:54: -sys-cli:x:60: +sysrepo:x:60: +klish:x:70: netdev:x:82: users:x:100: nobody:x:65534: diff --git a/package/skeleton-init-finit/skeleton/etc/passwd b/package/skeleton-init-finit/skeleton/etc/passwd index a2c662ba..38a20ce2 100644 --- a/package/skeleton-init-finit/skeleton/etc/passwd +++ b/package/skeleton-init-finit/skeleton/etc/passwd @@ -6,5 +6,6 @@ sync:x:4:100:sync:/bin:/bin/sync mail:x:8:8:mail:/var/spool/mail:/bin/false www-data:x:33:33:www-data:/var/www:/bin/false backup:x:34:34:backup:/var/backups:/bin/false -sys-cli:x:60:60:CLI capability:/var:/bin/false +sysrepo:x:60:60:sysrepo:/var:/bin/false +klish:x:70:70:CLI capability:/var:/bin/false nobody:x:65534:65534:nobody:/home:/bin/false diff --git a/package/skeleton-init-finit/skeleton/etc/shadow b/package/skeleton-init-finit/skeleton/etc/shadow index 820b8fee..caa531dd 100644 --- a/package/skeleton-init-finit/skeleton/etc/shadow +++ b/package/skeleton-init-finit/skeleton/etc/shadow @@ -5,6 +5,7 @@ sys:*::::::: sync:*::::::: mail:*::::::: www-data:*::::::: -sys-cli:*::::::: +sysrepo:*::::::: +klish:*::::::: backup:*::::::: nobody:*::::::: diff --git a/src/confd/src/system.c b/src/confd/src/system.c index 33a371be..26941ce6 100644 --- a/src/confd/src/system.c +++ b/src/confd/src/system.c @@ -558,9 +558,9 @@ static void del_groups(const char *user, const char **groups) static void adjust_access(const char *user, const char *shell) { if (strcmp(shell, "/bin/false")) - add_group(user, "sys-cli"); + add_group(user, "klish"); else - del_group(user, "sys-cli"); + del_group(user, "klish"); } /* XXX: Currently Infix only has admin and non-admins as a group */ @@ -615,7 +615,7 @@ static int is_valid_username(const char *user) return 1; } -static char *sys_find_usable_shell(sr_session_ctx_t *sess, char *name) +static char *sys_find_usable_shell(sr_session_ctx_t *sess, const char *name) { const char *conf = NULL; char *shell = NULL; diff --git a/test/case/misc/start_from_startup/Readme.adoc b/test/case/misc/start_from_startup/Readme.adoc index 5669c681..e5b93969 100644 --- a/test/case/misc/start_from_startup/Readme.adoc +++ b/test/case/misc/start_from_startup/Readme.adoc @@ -19,7 +19,7 @@ endif::topdoc[] . Configure . Reboot and wait for the unit to come back . Verify user admin is now in wheel group -. Verify user admin is now in sys-cli group +. Verify user admin is now in sysrepo group <<< diff --git a/test/case/misc/start_from_startup/test.py b/test/case/misc/start_from_startup/test.py index 92a0c967..38688678 100755 --- a/test/case/misc/start_from_startup/test.py +++ b/test/case/misc/start_from_startup/test.py @@ -24,8 +24,8 @@ with infamy.Test() as test: if not tgtssh.runsh("grep wheel /etc/group | grep 'admin'"): test.fail() - with test.step("Verify user admin is now in sys-cli group"): - if not tgtssh.runsh("grep sys-cli /etc/group | grep 'admin'"): + with test.step("Verify user admin is now in sysrepo group"): + if not tgtssh.runsh("grep sysrepo /etc/group | grep 'admin'"): test.fail() test.succeed() diff --git a/test/case/statd/system/system/run/getent_shadow b/test/case/statd/system/system/run/getent_shadow index a286e12d..8f3f8e3b 100644 --- a/test/case/statd/system/system/run/getent_shadow +++ b/test/case/statd/system/system/run/getent_shadow @@ -5,7 +5,7 @@ sys:*::::::: sync:*::::::: mail:*::::::: www-data:*::::::: -sys-cli:*::::::: +sysrepo:*::::::: backup:*::::::: nobody:*::::::: yangnobody:*:::::::