nut: improve rpcd acl / luci-app-acl effectiveness#30055
Open
danielfdickinson wants to merge 1 commit into
Open
nut: improve rpcd acl / luci-app-acl effectiveness#30055danielfdickinson wants to merge 1 commit into
danielfdickinson wants to merge 1 commit into
Conversation
2 tasks
openwrt-ai
reviewed
Jul 21, 2026
openwrt-ai
left a comment
openwrt-ai
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed 1 new commit; the commit message accurately describes the changes.
Generated by Claude Code
Reduce opportunities for an untrusted user with UCI write access to escalate privileges or write arbitrary configurations (i.e. config not part of their ACL). * Introduces config_get_single which only allows accepts 7-bit ASCII characters from UCI configuration settings * Splits UCI configuration files into main for each service, and a [service]_root config. The _root configuration holds any configuration which is or could lead to root-equivalence (such as setting RUNAS user, and defining executable notification commands). * Uses config_load in a subshell where needed, so that the _root configurations do not get mixed in with the non-_root configurations. * More validation of inputs Hotplug scripts do not require changes, as they only use the non-root upsd configs, and have a separate variable context, so isolating their config_load in a subshell is not necessary. Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
danielfdickinson
force-pushed
the
pr-nut-improve-acl-effectiveness
branch
from
July 21, 2026 07:06
4846a40 to
19955db
Compare
danielfdickinson
marked this pull request as ready for review
July 21, 2026 07:08
openwrt-ai
reviewed
Jul 22, 2026
openwrt-ai
left a comment
openwrt-ai
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed 1 new commit; no new issues found.
The changes since the last review are all correct fixes: removing the duplicate check_safe_hostname_or_ip definition, correcting the log_config_load_error label to nut_monitor_root, fixing the interface_reload_delay validation (the value is now assigned from val before the check), and switching exit 1 to return 1 in loop_through_drivers for consistency with its callers.
Generated by Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📦 Package Details
Maintainer: @danielfdickinson
Description:
Reduce opportunities for an untrusted user with UCI write access to escalate privileges or write arbitrary configurations (i.e. config not part of their ACL).
Hotplug scripts do not require changes, as they only use the non-root upsd configs, and have a separate variable context, so isolating their config_load in a subshell is not necessary.
Corresponding LuCI PR is openwrt/luci#8851
🧪 Run Testing Details
Lightly tested
✅ Formalities