Repository navigation
file: allow exec to return stdout as a file descriptor - #40
Open
JuliusBairaktaris wants to merge 1 commit into
Open
JuliusBairaktaris wants to merge 1 commit into
JuliusBairaktaris wants to merge 1 commit into
Conversation
rpc_file_exec captures stdout and stderr into ustreams capped at RPC_FILE_MAX_SIZE (256 KB); exceeding the cap fails the request with UBUS_STATUS_NOT_SUPPORTED and no output at all. That cap makes the method unusable for carrying a config backup archive. A non-root uhttpd cannot build a LuCI config backup because cgi-io forks /sbin/sysupgrade --create-backup as a CGI child inheriting uhttpd's uid, which cannot read /etc/shadow or 0600 configs. Letting rpcd run the command and hand the output back as a file descriptor keeps those reads in the root daemon. The new optional "stream" field (default false) writes the child's stdout to an anonymous memfd instead of a ustream buffer. When stream is false or absent the behaviour is byte-identical to before; stderr is still returned inline and capped as today. The memfd is attached to the deferred reply and carried to the caller via ubus fd passing; it is the same open file description opened by root, so the receiver needs no DAC bypass. The memfd is capped at 16 MB; the kernel enforces the cap via RLIMIT_FSIZE, killing a child that writes past the limit with SIGXFSZ at exactly the cap. Exit codes follow the shell convention: a signal-killed child reports 128 plus the signal number, so this surfaces as 153 (128 + SIGXFSZ) rather than the misleading 0 that WEXITSTATUS() yields for a signal death or a silently truncated stream. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
JuliusBairaktaris
force-pushed
the
file-exec-stream-fd
branch
from
August 15, 2026 08:05
80053df to
1e12158
Compare
This was referenced Aug 7, 2026
Author
|
Adds This is the primitive that lets cgi-io hand back a |
This was referenced Aug 15, 2026
JuliusBairaktaris
added a commit
to JuliusBairaktaris/luci
that referenced
this pull request
Sep 7, 2026
openwrt/cgi-io#6 moves archive creation to rpcd's file exec method so that it keeps working when uhttpd runs as a non-root user, and openwrt/rpcd#40 returns the child's stdout as a file descriptor so the archive is streamed rather than buffered into the ubus reply. rpcd matches the requested command against the caller's session ACL, so the grant names the exact command line. Depends on openwrt/cgi-io#6 and openwrt/rpcd#40. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
JuliusBairaktaris
force-pushed
the
file-exec-stream-fd
branch
from
October 2, 2026 12:35
1e12158 to
fb36d6c
Compare
JuliusBairaktaris
added a commit
to JuliusBairaktaris/luci
that referenced
this pull request
Oct 2, 2026
openwrt/cgi-io#6 moves archive creation to rpcd's file exec method so that it keeps working when uhttpd runs as a non-root user, and openwrt/rpcd#40 returns the child's stdout as a file descriptor so the archive is streamed rather than buffered into the ubus reply. rpcd matches the requested command against the caller's session ACL, so the grant names the exact command line. Depends on openwrt/cgi-io#6 and openwrt/rpcd#40. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an optional
streamflag tofile exec. When it is set, the child'sstdout goes to a
memfdand the descriptor is returned over ubus instead ofinline. Today stdout is returned inline, and output over 256 KB fails the call
with no output at all, which rules out returning a backup archive.
The memfd is capped at 16 MB with
RLIMIT_FSIZEin the child. If the childhits the cap, the call still completes, the fd is attached, and
codeis128 + the signal number, as in a shell. Without
streamnothing changes.openwrt/cgi-io#6 uses this to run the sysupgrade backup through rpcd. It is a
prerequisite for openwrt/openwrt#24740 and pairs with #38.
Tested end to end through cgi-io#6 on an ipq807x router. I have not tested
hitting the 16 MB cap.
Would you rather an oversized stream fail the call with
UBUS_STATUS_NOT_SUPPORTEDinstead?I used AI to help me write the change.