Dushnilin
603c0df91b
- ci: make frontend CI read-only with strict diff check and deterministic calls.json - ci: pin external GitHub Actions in workflows to immutable commit SHAs - ci: add openwrt-e2e blocking gate job running docker_e2e_test.sh - fix(diagnostic): fix contstants.ts typo and update all 13 import sites - fix(acl): remove unused /bin/busybox exec from rpcd ACL and add regression test - feat(updates): add low-space update fallback when creating sing-box.old is impossible - fix(routes): preserve dedicated Discord gateway subnets (162.159.128.0/21) - feat(ui): implement responsive auto-fit grid and mobile modal viewport bounds - test: add viewport regression test suite in vitest
27 lines
978 B
Bash
27 lines
978 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
ACL="$ROOT_DIR/luci-app-tachyon/root/usr/share/rpcd/acl.d/luci-app-tachyon.json"
|
|
|
|
fail() {
|
|
echo "FAIL: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
[ -f "$ACL" ] || fail "LuCI ACL file is missing"
|
|
|
|
# BusyBox is a multi-call binary (sh, wget, nc, rm, dd, ...). Granting LuCI
|
|
# generic exec access to it effectively broadens the web UI capability far
|
|
# beyond the explicit commands Tachyon needs. Keep this regression guard next
|
|
# to the ACL so the capability cannot be reintroduced accidentally.
|
|
if grep -Fq '"/bin/busybox"' "$ACL"; then
|
|
fail "LuCI ACL must not grant generic /bin/busybox exec access"
|
|
fi
|
|
|
|
# The file is JSON consumed by rpcd; catch accidental syntax damage without
|
|
# depending on jq, which is not guaranteed to exist in OpenWrt test images.
|
|
node -e 'JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"))' "$ACL"
|
|
|
|
echo "OK: LuCI ACL keeps generic BusyBox execution disabled"
|