From fb00719069dc790f2a5d01249fefd5e56bf50162 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Fri, 23 Aug 2024 08:53:24 +0200
Subject: [PATCH] package/klish: bump for droprivs refactor of script plugin

As of KernelKit Klish @ 710a631 the script plugin has been refactored to
run all commands as the logged in user instead of as root.  The default
admin user is member of the wheel group, which allows access to sysrepo
and sudo access to containers thanks to NOPASSWD rights.

The doas script is a dummy wrapper to silence 'sudo -n' output for users
without any privileges.

As of this commit, unprivileged users can no longer copy, show, or in
any other way manipulate the system configuraiton.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 board/common/rootfs/usr/bin/doas          |  5 +++
 package/klish/klish.hash                  |  2 +-
 package/klish/klish.mk                    |  2 +-
 src/klish-plugin-infix/xml/containers.xml | 46 +++++++++++------------
 4 files changed, 30 insertions(+), 25 deletions(-)
 create mode 100755 board/common/rootfs/usr/bin/doas

diff --git a/board/common/rootfs/usr/bin/doas b/board/common/rootfs/usr/bin/doas
new file mode 100755
index 00000000..ca55870a
--- /dev/null
+++ b/board/common/rootfs/usr/bin/doas
@@ -0,0 +1,5 @@
+#!/bin/sh
+# Silly wrapper around sudo to prevent it from printing an error for
+# unprivileged users: sudo: a password is required
+
+id -nG $LOGNAME | grep -qw wheel && sudo -n $@
diff --git a/package/klish/klish.hash b/package/klish/klish.hash
index 893f65ae..faf03545 100644
--- a/package/klish/klish.hash
+++ b/package/klish/klish.hash
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  d4f6ab771579defb7295e596b259ff8713fe26e85b6e79fb83789cd63be12dbb  klish-894b0ba24ffcb5072b4b18f3b5aee3500d05cd86-br1.tar.gz
+sha256  4293851b355285be3564873fc1f92ce5a3f4386fe8ce1195f18a79b55b5c99ac  klish-710a6314c00bc0485221769d73a5b5d6897c1d81-br1.tar.gz
diff --git a/package/klish/klish.mk b/package/klish/klish.mk
index f55dae1b..9cf8311b 100644
--- a/package/klish/klish.mk
+++ b/package/klish/klish.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-KLISH_VERSION = 894b0ba24ffcb5072b4b18f3b5aee3500d05cd86
+KLISH_VERSION = 710a6314c00bc0485221769d73a5b5d6897c1d81
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
diff --git a/src/klish-plugin-infix/xml/containers.xml b/src/klish-plugin-infix/xml/containers.xml
index aca03459..b48918fd 100644
--- a/src/klish-plugin-infix/xml/containers.xml
+++ b/src/klish-plugin-infix/xml/containers.xml
@@ -37,7 +37,7 @@
 <COMMAND name="container" help="Manage containers, images, and volumes" mode="switch">
   <COMMAND name="prune" help="Clean up all unused containers, images and volume data">
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
-      podman system prune
+      doas podman system prune
     </ACTION>
   </COMMAND>
 
@@ -45,7 +45,7 @@
   <COMMAND name="connect" help="Start a shell inside a container, if available">
     <PARAM name="name" ptype="/CONTAINERSa" help="Container name" />
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
-      container shell $KLISH_PARAM_name
+      doas container shell $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 
@@ -61,7 +61,7 @@
         echo "Missing container name."
       else
         cmd=${KLISH_PARAM_command:-sh}
-        container exec $KLISH_PARAM_name $cmd
+        doas container exec $KLISH_PARAM_name $cmd
       fi
     </ACTION>
   </COMMAND>
@@ -79,7 +79,7 @@
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
       creds=${KLISH_PARAM_creds:+-c $KLISH_PARAM_creds}
       cd /var/lib/containers/oci
-      container $creds load $KLISH_PARAM_url $KLISH_PARAM_name
+      doas container $creds load $KLISH_PARAM_url $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 
@@ -92,21 +92,21 @@
     </SWITCH>
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
       creds=${KLISH_PARAM_creds:+--creds=$KLISH_PARAM_creds}
-      container pull $creds $KLISH_PARAM_image
+      doas container pull $creds $KLISH_PARAM_image
     </ACTION>
   </COMMAND>
 
   <COMMAND name="remove" help="Remove a container image from local storage">
     <PARAM name="name" ptype="/IMAGES" help="Image name" />
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
-      container remove $KLISH_PARAM_name
+      doas container remove $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 
   <COMMAND name="restart" help="Restart a crashed container">
     <PARAM name="name" ptype="/CONTAINERSa" help="Container name" />
     <ACTION sym="script" out="tty" interrupt="true">
-      container restart $KLISH_PARAM_name
+      doas container restart $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 
@@ -122,12 +122,12 @@
     </SWITCH>
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
       port=${KLISH_PARAM_port:+-p $KLISH_PARAM_port}
-      container $port run $KLISH_PARAM_image ${KLISH_PARAM_command}
+      doas container $port run $KLISH_PARAM_image ${KLISH_PARAM_command}
     </ACTION>
     <SWITCH name="optional" min="0">
       <COMMAND name="detach" help="Run container in background and print container ID">
         <ACTION sym="script" out="tty">
-	  container -d $port run $KLISH_PARAM_image ${KLISH_PARAM_command}
+	  doas container -d $port run $KLISH_PARAM_image ${KLISH_PARAM_command}
 	</ACTION>
       </COMMAND>
     </SWITCH>
@@ -142,69 +142,69 @@
     </SWITCH>
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
       cd /var/lib/containers/oci
-      container save $KLISH_PARAM_name $KLISH_PARAM_file
+      doas container save $KLISH_PARAM_name $KLISH_PARAM_file
     </ACTION>
   </COMMAND>
 
   <COMMAND name="shell" help="Start a shell inside a container, if available">
     <PARAM name="name" ptype="/CONTAINERSa" help="Container name" />
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
-      container shell $KLISH_PARAM_name
+      doas container shell $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 
   <COMMAND name="start" help="Start a container">
     <PARAM name="name" ptype="/CONTAINERSa" help="Container name" />
     <ACTION sym="script" out="tty" interrupt="true">
-      container start $KLISH_PARAM_name
+      doas container start $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 
   <COMMAND name="stop" help="Stop a container">
     <PARAM name="name" ptype="/CONTAINERS" help="Container name" />
     <ACTION sym="script" out="tty" interrupt="true">
-      container stop $KLISH_PARAM_name
+      doas container stop $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 
   <COMMAND name="upgrade" help="Upgrade image of a container (writable layer is lost!)">
     <PARAM name="name" ptype="/CONTAINERS" help="Container name" />
     <ACTION sym="script" out="tty" interrupt="true">
-      container upgrade $KLISH_PARAM_name
+      doas container upgrade $KLISH_PARAM_name
     </ACTION>
   </COMMAND>
 </COMMAND>
 
 <COMMAND name="show" help="Show system status and configuration files" mode="switch">
   <COMMAND name="container" help="Show container status">
-    <ACTION sym="script">container show</ACTION>
+    <ACTION sym="script">doas container show</ACTION>
 
     <SWITCH name="optional" min="0">
       <COMMAND name="all" help="Show all containers (default only running)">
-        <ACTION sym="script">container -a show</ACTION>
+        <ACTION sym="script">doas container -a show</ACTION>
       </COMMAND>
       <COMMAND name="log" help="Show container log (alias for show log container)">
-	<ACTION sym="script">cat /log/container</ACTION>
+	<ACTION sym="script">doas -u $USER cat /log/container</ACTION>
       </COMMAND>
       <COMMAND name="images" help="Show container images">
-        <ACTION sym="script">container show images</ACTION>
+        <ACTION sym="script">doas container show images</ACTION>
         <SWITCH name="optional" min="0">
           <COMMAND name="all" help="All images (default hides intermediate imaages)">
-            <ACTION sym="script">container -a show images</ACTION>
+            <ACTION sym="script">doas container -a show images</ACTION>
           </COMMAND>
         </SWITCH>
       </COMMAND>
       <COMMAND name="oci" help="Show OCI archives (for loading as image)">
-        <ACTION sym="script">container list oci</ACTION>
+        <ACTION sym="script">doas container list oci</ACTION>
       </COMMAND>
       <COMMAND name="stat" help="Show continuous containers stats (Ctrl-C aborts)">
-	<ACTION sym="script">container stat</ACTION>
+	<ACTION sym="script">doas container stat</ACTION>
       </COMMAND>
       <COMMAND name="usage" help="Show container resource usage">
-        <ACTION sym="script">podman system df -v</ACTION>
+        <ACTION sym="script">doas podman system df -v</ACTION>
       </COMMAND>
       <COMMAND name="volumes" help="Show container volumes">
-        <ACTION sym="script">container show volumes</ACTION>
+        <ACTION sym="script">doas container show volumes</ACTION>
       </COMMAND>
     </SWITCH>
   </COMMAND>