matthew/sonic-buildimage
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Support readonly vtysh for sudoers (#7383)

Browse Source 
Why I did it
Support readonly version of the command vtysh

How I did it
Check if the command starting with "show", and verify only contains single command in script.
This commit is contained in:
xumia 2021-04-25 16:32:02 +08:00 committed by Danny Allen
parent 17d5e69c5b
commit 1b05982727
5 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
dockers/docker-fpm-frr/base_image_files/rvtysh Executable file
View File

@ -0,0 +1,22 @@
#!/bin/bash
# The command rvtysh can be run as root priviledge by any user without password, only allow to execute readonly commands.
# The options in the show command cannot contains any charactors to run multiple sub-commands potentially, such as "\n", "\r", "|", "&", "$" and ";".
if printf -- "$*" | grep -qPz '[\n\r|&$;]'; then
echo "Not allow to run the command, please use the comand 'sudo vtysh' instead." 1>&2
exit 1
fi
# The sub commands must start with "show"
LAST_PARA=
for para in "$@"
do
if [ "$LAST_PARA" == "-c" ] && [[ "$para" != show* ]]; then
echo "Not allow to run the command '$para', please use the comand 'sudo vtysh' instead." 1>&2
exit 1
fi
LAST_PARA=$para
done
vtysh "$@"

1
dockers/docker-fpm-quagga/base_image_files/rvtysh Symbolic link
View File

@ -0,0 +1 @@
../../docker-fpm-frr/base_image_files/rvtysh

1
files/image_config/sudoers/sudoers
View File

@ -30,6 +30,7 @@ Cmnd_Alias READ_ONLY_CMDS = /bin/cat /var/log/syslog*, \
/usr/bin/lldpctl, \
/usr/bin/sensors, \
/usr/bin/tail -F /var/log/syslog, \
/usr/bin/rvtysh *, \
/usr/bin/vtysh -c show *, \
/usr/bin/vtysh -n [0-9] -c show *, \
/usr/local/bin/decode-syseeprom, \

1
rules/docker-fpm-frr.mk
View File

@ -27,6 +27,7 @@ $(DOCKER_FPM_FRR)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
$(DOCKER_FPM_FRR)_FILES += $(SUPERVISOR_PROC_EXIT_LISTENER_SCRIPT)
$(DOCKER_FPM_FRR)_BASE_IMAGE_FILES += vtysh:/usr/bin/vtysh
$(DOCKER_FPM_FRR)_BASE_IMAGE_FILES += rvtysh:/usr/bin/rvtysh
$(DOCKER_FPM_FRR)_BASE_IMAGE_FILES += TSA:/usr/bin/TSA
$(DOCKER_FPM_FRR)_BASE_IMAGE_FILES += TSB:/usr/bin/TSB
$(DOCKER_FPM_FRR)_BASE_IMAGE_FILES += TSC:/usr/bin/TSC

1
rules/docker-fpm-quagga.mk
View File

@ -13,3 +13,4 @@ $(DOCKER_FPM_QUAGGA)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
$(DOCKER_FPM_QUAGGA)_FILES += $(SUPERVISOR_PROC_EXIT_LISTENER_SCRIPT)
$(DOCKER_FPM_QUAGGA)_BASE_IMAGE_FILES += vtysh:/usr/bin/vtysh
$(DOCKER_FPM_QUAGGA)_BASE_IMAGE_FILES += rvtysh:/usr/bin/rvtysh