Backported from origin/main 5420fb01f2
Includes the latest DRAM ECC status, with/without sudo, and temperature.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a backport of the following commits from origin/main: 3b24fabe6a04fb92e80b4ad969653e03ece21256a8b7d91e4d26e3110977ab4f83fbc6
---
cli: fix 'copy FILE running-config' use-case
When copying to the running datastore we cannot use sr_copy_config(),
instead we must use sr_replace_config(). This fix covers both the case
of 'copy startup-config running-config' and 'copy FILE running-config'.
Fixes#1203
---
cli: add 'validate', or '-n', dry run to copy command
This commit adds config file validation to the copy command, discussed
in #373. Allowing users to test their config files before restoring a
backup. The feature could also be used for the automatic rollback when
downgrading to an earlier version of the OS.
Fixes#373
---
cli: fix copy to missing startup-config file
Fixes#981
---
cli: restrict copy and erase commands
This is a follow-up to PR #717 where path traversal protection was
discussed. A year later and it's clear that having a user-friendly
copy tool in the shell is a good thing, but that we proably want to
restrict what it can do when called from the CLI.
A sanitize flag (-s) is added to control the behavior, when used in the
shell without -s, both commands act like traditional UNIX tools and do
assume . for relative paths, and allow ../, whereas when running from
the CLI only /media/ is allowed and otherwise files are assumed to be
in $HOME or /cfg
---
cli: sanitize regular file to file copy
The regular file-to-file copy, was missing calls to cfg_adjust(), this
commit fixes that and adds some helpful comments for each use-case.
Also, drop insecure mktemp() in favor of our own version which uses the
basename of the remote source file.
---
bin: add bash completion for copy command
Add bash completion for the common datastores, like we already do in the
CLI, and update the usage text accordingly.
Also, make sure to install to /usr/bin, not /bin since we've now merged
the hierarchies since a while back.
---
bin: copy: Refactor
copy() made some...creative...use of control flow that made it quite
difficult to follow.
Take a first priciples approach to simplify the logic.
---
bin: copy: Always get startup from sysrepo
This will make sure to apply NACM rules for all the data. It also
makes it possible for a luser access a subset of the data, even if
they to do not have read access to /cfg/startup-config.cfg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The code assumes both SRC and DST is passed, here we ensure this
early.
Prior to this patch:
root@host:~$ copy foo
Segmentation fault (core dumped)
Signed-off-by: Richard Alpe <richard@bit42.se>
Prior to this patch the errno value was overwritten by getgrgid()
making the printouts invalid:
Error: setting group owner wheel (10) on /cfg/startup-config.cfg:
Success
Signed-off-by: Richard Alpe <richard@bit42.se>
Avoid a theoretical race between getting the number of groups a user
belongs to and actually processing them. We should not need to check
the return value of getgrouplist() as we know the number of groups fit
inside the buffer.
Signed-off-by: Richard Alpe <richard@bit42.se>
As per earlier decsision, the .cfg suffix is no longer implied when a
user copy to a regular file, so we should allow tab completion in the
copy command to show foo.cfg, otherwise the copy command will fail.
Skip /cfg/startup-config.cfg since it's treated as a special case and
added to the list by the infix_datastore() plugin function.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When copying a file to a directory, the file should be accessible (read
+ write) by all members of the group that are allowed write access.
E.g., an 'admin' level user creating a new file /cfg/foo.cfg should
result in the file being owned by $LOGNAME:wheel with 0660 perms,
because /cfg is root:wheel.
Writing to already existing file, e.g., created by 'root' at first boot,
say /cfg/startup-config.cfg should be possible by all members of the
'wheel' group. In this case thef file already exists as root:wheel and
any user trying to chgrp it will fail, this is fine.
Fixes#977
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For future readers, the user paramenter to the copy() function is
actually the remote user in any curl command.
Also, realign columns in infix_config[].
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg