confd: ensure admin users have full access to vtysh #946
Conversation
| @@ -45,6 +45,12 @@ static char *os = NULL; | |||
| static char *nm = NULL; | |||
| static char *id = NULL; | |||
|
|
|||
| static const char *admin_groups[] = { | |||
| "wheel", | |||
| "frrvty", | |||
There was a problem hiding this comment.
| "frrvty", | |
| #ifdef HAVE_FRR | |
| "frrvty", | |
| #endif |
As this list grows, having this type of structure might make it easier to keep track of which deps pull in which groups. It would also avoid the need for group_exists(). Just a thought.
Now that I think about it: Is there a podman group that we should add for builds with container support?
There was a problem hiding this comment.
Good point. I'll add that to my commit 😀👍
Not that I've seen, but I'll have a look again at podman. I'm still at it with the other related issues anyway.
There was a problem hiding this comment.
Dropped the group-exists check, added a comment about future optional support for FRR.
I've also looked into if podman has/requires any group -- answer is none.
So, provided this latest build passes, this feature is complete.
troglobit
force-pushed
the
admin-vtysh-privs
branch
from
0fedcde to
addfd3f
Compare
Future Infix defconfigs for smaller system may exclude Frr and set all routes directly in the kernel. So failing to add a user to the frrvty group should not cause an error, hence the new group_exists(). Signed-off-by: Joachim Wiberg <[email protected]>
troglobit
force-pushed
the
admin-vtysh-privs
branch
from
addfd3f to
83797ca
Compare
Description
Future Infix defconfigs for smaller system may exclude Frr and set all routes directly in the kernel. So failing to add a user to the
frrvtygroup should not cause an error, hence the newgroup_exists()function.Note, the new
*_groups()functions could also be used forguestandoperatorlevel users. We've talked opening up guest access to sysrepo, relying fully on NACM, in which case we could create a new groupsysrepofor/dev/shm/*files.Checklist
Tick relevant boxes, this PR is-a or has-a: