mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-30 20:43:02 +02:00
Richard Alpe
ac89f94580
Non-privileged users in the sys-cli group can now access sysrepo data. The data is now solely protected by the NCAM rules and not Unix file permissions. Any stray user that's not part of the (default) sys-cli group still can't access syrepo, like users added from the shell. Fixes #932 Signed-off-by: Richard Alpe <richard@bit42.se>
144 lines
3.0 KiB
Bash
Executable File
144 lines
3.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# load [-b] <startup-config | failure-config | test-config>
|
|
#
|
|
# Import a configuration to the sysrepo datastore using `sysrepocfg -Ifile`
|
|
#
|
|
# If the '-b' option is used we set the Finit <usr/bootstrap> condition if
|
|
# sysrepocfg returns OK. This to be able to detect and trigger the Infix
|
|
# Fail Secure Mode at boot.
|
|
#
|
|
|
|
banner_append()
|
|
{
|
|
printf "\n%s\n" "$*" | tee -a \
|
|
/etc/banner \
|
|
/etc/issue \
|
|
/etc/issue.net \
|
|
>/dev/null
|
|
return 0
|
|
}
|
|
|
|
# Ensure correct ownership and permissions, in particular after factory reset
|
|
# Created by the system, writable by any user in the admin group.
|
|
perms()
|
|
{
|
|
chown root:wheel "$1"
|
|
chmod 0660 "$1"
|
|
}
|
|
|
|
note()
|
|
{
|
|
msg="$*"
|
|
logger -I $$ -p user.notice -t load -- "$msg"
|
|
}
|
|
|
|
err()
|
|
{
|
|
msg="$*"
|
|
logger -I $$ -p user.error -t load -- "$msg"
|
|
}
|
|
|
|
|
|
# shellcheck disable=SC1091
|
|
. /etc/confdrc
|
|
|
|
sysrepocfg=sysrepocfg
|
|
while getopts "t:" opt; do
|
|
case ${opt} in
|
|
t)
|
|
sysrepocfg="$sysrepocfg -t $OPTARG"
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
done
|
|
shift $((OPTIND - 1))
|
|
|
|
if [ $# -lt 1 ]; then
|
|
err "No configuration file supplied"
|
|
exit 1
|
|
fi
|
|
|
|
|
|
config=$1
|
|
|
|
if [ -f "/mnt/aux/test-mode" ] && [ "$config" = "startup-config" ]; then
|
|
|
|
if [ -f "/mnt/aux/test-override-startup" ]; then
|
|
rm -f "/mnt/aux/test-override-startup"
|
|
else
|
|
note "Test mode detected, switching to test-config"
|
|
config="test-config"
|
|
fi
|
|
fi
|
|
|
|
if [ -f "$config" ]; then
|
|
fn="$config"
|
|
else
|
|
if [ -f "$CFG_PATH_/${config}.cfg" ]; then
|
|
fn="$CFG_PATH_/${config}.cfg"
|
|
else
|
|
fn="$SYS_PATH_/${config}.cfg"
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f "$fn" ]; then
|
|
case "$config" in
|
|
startup-config)
|
|
note "startup-config missing, initializing running datastore from factory-config"
|
|
$sysrepocfg -C factory-default
|
|
rc=$?
|
|
note "saving factory-config to $STARTUP_CFG ..."
|
|
$sysrepocfg -f json -X"$STARTUP_CFG"
|
|
perms "$STARTUP_CFG"
|
|
exit $rc
|
|
;;
|
|
*)
|
|
err "No such file, $fn, aborting!"
|
|
exit 1
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
note "Loading $config ..."
|
|
if ! $sysrepocfg -v2 -I"$fn" -f json; then
|
|
case "$config" in
|
|
startup-config)
|
|
err "Failed loading $fn, reverting to Fail Secure mode!"
|
|
# On failure to load startup-config the system is in an undefined state
|
|
cat <<-EOF >/tmp/factory.json
|
|
{
|
|
"infix-factory-default:factory-default": {}
|
|
}
|
|
EOF
|
|
|
|
if ! $sysrepocfg -f json -R /tmp/factory.json; then
|
|
rm -f /etc/sysrepo/data/*startup*
|
|
rm -f /etc/sysrepo/data/*running*
|
|
rm -f /dev/shm/sr_*
|
|
killall sysrepo-plugind
|
|
fi
|
|
;;
|
|
failure-config)
|
|
err "Failed loading $fn, aborting!"
|
|
banner_append "CRITICAL ERROR: Logins are disabled, no credentials available"
|
|
initctl -nbq runlevel 9
|
|
;;
|
|
*)
|
|
err "Unknown config $config, aborting!"
|
|
;;
|
|
esac
|
|
|
|
exit 1
|
|
else
|
|
note "Success, syncing with startup datastore."
|
|
$sysrepocfg -v2 -d startup -C running
|
|
fi
|
|
|
|
note "Loaded $fn successfully."
|
|
if [ "$config" = "failure-config" ]; then
|
|
banner_append "ERROR: Corrupt startup-config, system has reverted to default login credentials"
|
|
else
|
|
perms "$fn"
|
|
fi
|