Repository navigation
luci-mod-system, luci-mod-status: permit sysupgrade --create-backup and legacy iptables-save - #8947
Open
JuliusBairaktaris wants to merge 2 commits into
Open
JuliusBairaktaris wants to merge 2 commits into
JuliusBairaktaris wants to merge 2 commits into
Conversation
Contributor
Author
|
@jow- — review ping. One-line ACL grant permitting exactly Needed by openwrt/cgi-io#6, which is in turn needed by openwrt/openwrt#24558. |
This was referenced Aug 15, 2026
openwrt-ai
reviewed
Aug 15, 2026
openwrt-ai
left a comment
openwrt-ai
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed 2 new commits. Both commit messages match their diffs, both files stay valid JSON, and the ACL strings are in the correct read sections. Two inline notes — the main one is a question about whether rpcd's file.exec can actually carry a backup tarball, since it is fully buffered and returns stdout as a NUL-terminated string.
Generated by Claude Code
JuliusBairaktaris
force-pushed
the
backup-create-acl
branch
from
September 7, 2026 09:31
7b773aa to
b63385b
Compare
JuliusBairaktaris
changed the title
openwrt-ai
reviewed
Sep 7, 2026
JuliusBairaktaris
force-pushed
the
backup-create-acl
branch
from
October 2, 2026 12:35
b63385b to
04dd79b
Compare
openwrt-ai
reviewed
Oct 2, 2026
openwrt/cgi-io#6 moves archive creation to rpcd's file exec method so that it keeps working when uhttpd runs as a non-root user, and openwrt/rpcd#40 returns the child's stdout as a file descriptor so the archive is streamed rather than buffered into the ubus reply. rpcd matches the requested command against the caller's session ACL, so the grant names the exact command line. Depends on openwrt/cgi-io#6 and openwrt/rpcd#40. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Only the non-legacy iptables-save pair is in the session ACL, but the firewall status page runs the legacy pair when those binaries exist. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
JuliusBairaktaris
force-pushed
the
backup-create-acl
branch
from
October 24, 2026 09:50
04dd79b to
88ab465
Compare
openwrt-ai
reviewed
Oct 29, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two ACL fixes.
luci-mod-status: the firewall status page runs
iptables-legacy-saveandip6tables-legacy-savewhen they exist, but only the non-legacy commands arein the ACL. cgi-io refuses the call, LuCI turns the error into an empty string,
and the legacy tables show up empty. This adds the legacy commands. It fixes
current master on its own. I found this by reading the code and have not
reproduced it on a device.
luci-mod-system: adds
/sbin/sysupgrade --create-backup -to the backup ACL.It only takes effect once openwrt/cgi-io#6 runs the backup through rpcd (with
openwrt/rpcd#40), which is needed for a non-root uhttpd
(openwrt/openwrt#24740).
Should the luci-mod-status commit go in now and the luci-mod-system one wait
for cgi-io#6?
I used AI to help me write the change.