From b58550367c1af3cf808074e14cb6697cea63f22c Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Wed, 7 Jan 2026 18:25:15 +0100 Subject: [PATCH] sys: rename sys-cli -> sysrepo + klish Previously the sys-cli group was for interactive shell access, but with ever changing requirements this split has become necessary. This commit introduces the 'sysrepo' group for low-level access to all sysrepo commands, i.e., bootstrap only. For user-level shell access a 'klish' group is added which allows users to connect to the CLI. This is now the only group users, including the default 'admin', are members of, effectively making the new 'copy' tool the norm. Signed-off-by: Joachim Wiberg --- configs/aarch32_defconfig | 2 +- configs/aarch32_minimal_defconfig | 2 +- configs/aarch64_defconfig | 2 +- configs/aarch64_minimal_defconfig | 2 +- configs/riscv64_defconfig | 2 +- configs/x86_64_defconfig | 2 +- configs/x86_64_minimal_defconfig | 2 +- package/confd-test-mode/confd-test-mode.mk | 4 ++-- package/klish/klishd.conf | 5 ++--- package/skeleton-init-finit/skeleton/etc/group | 3 ++- package/skeleton-init-finit/skeleton/etc/passwd | 3 ++- package/skeleton-init-finit/skeleton/etc/shadow | 3 ++- src/confd/src/system.c | 6 +++--- test/case/misc/start_from_startup/Readme.adoc | 2 +- test/case/misc/start_from_startup/test.py | 4 ++-- test/case/statd/system/system/run/getent_shadow | 2 +- 16 files changed, 24 insertions(+), 22 deletions(-) diff --git a/configs/aarch32_defconfig b/configs/aarch32_defconfig index 89c943f7..a33c38e1 100644 --- a/configs/aarch32_defconfig +++ b/configs/aarch32_defconfig @@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_ONIGURUMA=y BR2_PACKAGE_AVAHI_DAEMON=y diff --git a/configs/aarch32_minimal_defconfig b/configs/aarch32_minimal_defconfig index 4e5a8645..9aae459a 100644 --- a/configs/aarch32_minimal_defconfig +++ b/configs/aarch32_minimal_defconfig @@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_ONIGURUMA=y BR2_PACKAGE_AVAHI_DAEMON=y diff --git a/configs/aarch64_defconfig b/configs/aarch64_defconfig index 0d7d02c1..da687377 100644 --- a/configs/aarch64_defconfig +++ b/configs/aarch64_defconfig @@ -63,7 +63,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y BR2_PACKAGE_ONIGURUMA=y diff --git a/configs/aarch64_minimal_defconfig b/configs/aarch64_minimal_defconfig index 1c7d00b7..34262285 100644 --- a/configs/aarch64_minimal_defconfig +++ b/configs/aarch64_minimal_defconfig @@ -34,7 +34,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc BR2_PACKAGE_ODHCP6C=y BR2_PACKAGE_STRACE=y BR2_PACKAGE_STRESS_NG=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_JQ=y BR2_PACKAGE_E2FSPROGS=y BR2_PACKAGE_DBUS_CXX=y diff --git a/configs/riscv64_defconfig b/configs/riscv64_defconfig index 660c0f42..30ddff4b 100644 --- a/configs/riscv64_defconfig +++ b/configs/riscv64_defconfig @@ -76,7 +76,7 @@ BR2_PACKAGE_LIBINPUT=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y BR2_PACKAGE_ONIGURUMA=y diff --git a/configs/x86_64_defconfig b/configs/x86_64_defconfig index 8ca1610f..ad451694 100644 --- a/configs/x86_64_defconfig +++ b/configs/x86_64_defconfig @@ -59,7 +59,7 @@ BR2_PACKAGE_LIBOPENSSL_BIN=y BR2_PACKAGE_LIBCURL_CURL=y BR2_PACKAGE_NETOPEER2_CLI=y BR2_PACKAGE_NSS_MDNS=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_LINUX_PAM=y BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y BR2_PACKAGE_ONIGURUMA=y diff --git a/configs/x86_64_minimal_defconfig b/configs/x86_64_minimal_defconfig index b50fed2e..3b9ce6c4 100644 --- a/configs/x86_64_minimal_defconfig +++ b/configs/x86_64_minimal_defconfig @@ -35,7 +35,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc BR2_PACKAGE_ODHCP6C=y BR2_PACKAGE_STRACE=y BR2_PACKAGE_STRESS_NG=y -BR2_PACKAGE_SYSREPO_GROUP="sys-cli" +BR2_PACKAGE_SYSREPO_GROUP="sysrepo" BR2_PACKAGE_JQ=y BR2_PACKAGE_E2FSPROGS=y BR2_PACKAGE_DBUS_CXX=y diff --git a/package/confd-test-mode/confd-test-mode.mk b/package/confd-test-mode/confd-test-mode.mk index aa144ed8..1a9f040c 100644 --- a/package/confd-test-mode/confd-test-mode.mk +++ b/package/confd-test-mode/confd-test-mode.mk @@ -26,8 +26,8 @@ define CONFD_TEST_MODE_INSTALL_YANG_MODULES $(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc endef define CONFD_TEST_MODE_PERMISSIONS - /etc/sysrepo/data/ r 660 root wheel - - - - - - /etc/sysrepo/data d 770 root wheel - - - - - + /etc/sysrepo/data/ r 660 root sysrepo - - - - - + /etc/sysrepo/data d 770 root sysrepo - - - - - endef define CONFD_TEST_MODE_CLEANUP rm -f /dev/shm/$(CONFD_TEST_MODE_SYSREPO_SHM_PREFIX)* diff --git a/package/klish/klishd.conf b/package/klish/klishd.conf index ccc5d0d9..b6e538fc 100644 --- a/package/klish/klishd.conf +++ b/package/klish/klishd.conf @@ -8,6 +8,5 @@ UnixSocketPath=/run/klishd.sock DBs=libxml2 # The group to set on the UNIX socket. By default, the socket retains the group -# of the user starting the daemon. The upstream sysrepo project recommends using -# the 'sysrepo' group to allow access to CLI tools. -SocketGroup=sysrepo +# of the user starting the daemon. +SocketGroup=klish diff --git a/package/skeleton-init-finit/skeleton/etc/group b/package/skeleton-init-finit/skeleton/etc/group index 2614592d..fccad8ec 100644 --- a/package/skeleton-init-finit/skeleton/etc/group +++ b/package/skeleton-init-finit/skeleton/etc/group @@ -20,7 +20,8 @@ backup:x:34: utmp:x:43: plugdev:x:46: lock:x:54: -sys-cli:x:60: +sysrepo:x:60: +klish:x:70: netdev:x:82: users:x:100: nobody:x:65534: diff --git a/package/skeleton-init-finit/skeleton/etc/passwd b/package/skeleton-init-finit/skeleton/etc/passwd index a2c662ba..38a20ce2 100644 --- a/package/skeleton-init-finit/skeleton/etc/passwd +++ b/package/skeleton-init-finit/skeleton/etc/passwd @@ -6,5 +6,6 @@ sync:x:4:100:sync:/bin:/bin/sync mail:x:8:8:mail:/var/spool/mail:/bin/false www-data:x:33:33:www-data:/var/www:/bin/false backup:x:34:34:backup:/var/backups:/bin/false -sys-cli:x:60:60:CLI capability:/var:/bin/false +sysrepo:x:60:60:sysrepo:/var:/bin/false +klish:x:70:70:CLI capability:/var:/bin/false nobody:x:65534:65534:nobody:/home:/bin/false diff --git a/package/skeleton-init-finit/skeleton/etc/shadow b/package/skeleton-init-finit/skeleton/etc/shadow index 820b8fee..caa531dd 100644 --- a/package/skeleton-init-finit/skeleton/etc/shadow +++ b/package/skeleton-init-finit/skeleton/etc/shadow @@ -5,6 +5,7 @@ sys:*::::::: sync:*::::::: mail:*::::::: www-data:*::::::: -sys-cli:*::::::: +sysrepo:*::::::: +klish:*::::::: backup:*::::::: nobody:*::::::: diff --git a/src/confd/src/system.c b/src/confd/src/system.c index 33a371be..26941ce6 100644 --- a/src/confd/src/system.c +++ b/src/confd/src/system.c @@ -558,9 +558,9 @@ static void del_groups(const char *user, const char **groups) static void adjust_access(const char *user, const char *shell) { if (strcmp(shell, "/bin/false")) - add_group(user, "sys-cli"); + add_group(user, "klish"); else - del_group(user, "sys-cli"); + del_group(user, "klish"); } /* XXX: Currently Infix only has admin and non-admins as a group */ @@ -615,7 +615,7 @@ static int is_valid_username(const char *user) return 1; } -static char *sys_find_usable_shell(sr_session_ctx_t *sess, char *name) +static char *sys_find_usable_shell(sr_session_ctx_t *sess, const char *name) { const char *conf = NULL; char *shell = NULL; diff --git a/test/case/misc/start_from_startup/Readme.adoc b/test/case/misc/start_from_startup/Readme.adoc index 5669c681..e5b93969 100644 --- a/test/case/misc/start_from_startup/Readme.adoc +++ b/test/case/misc/start_from_startup/Readme.adoc @@ -19,7 +19,7 @@ endif::topdoc[] . Configure . Reboot and wait for the unit to come back . Verify user admin is now in wheel group -. Verify user admin is now in sys-cli group +. Verify user admin is now in sysrepo group <<< diff --git a/test/case/misc/start_from_startup/test.py b/test/case/misc/start_from_startup/test.py index 92a0c967..38688678 100755 --- a/test/case/misc/start_from_startup/test.py +++ b/test/case/misc/start_from_startup/test.py @@ -24,8 +24,8 @@ with infamy.Test() as test: if not tgtssh.runsh("grep wheel /etc/group | grep 'admin'"): test.fail() - with test.step("Verify user admin is now in sys-cli group"): - if not tgtssh.runsh("grep sys-cli /etc/group | grep 'admin'"): + with test.step("Verify user admin is now in sysrepo group"): + if not tgtssh.runsh("grep sysrepo /etc/group | grep 'admin'"): test.fail() test.succeed() diff --git a/test/case/statd/system/system/run/getent_shadow b/test/case/statd/system/system/run/getent_shadow index a286e12d..8f3f8e3b 100644 --- a/test/case/statd/system/system/run/getent_shadow +++ b/test/case/statd/system/system/run/getent_shadow @@ -5,7 +5,7 @@ sys:*::::::: sync:*::::::: mail:*::::::: www-data:*::::::: -sys-cli:*::::::: +sysrepo:*::::::: backup:*::::::: nobody:*::::::: yangnobody:*:::::::