luci-base: whitelist file/write actions on /etc/rc.local

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/modules/luci-base/root/usr/share/rpcd/acl.d/luci-base.json b/modules/luci-base/root/usr/share/rpcd/acl.d/luci-base.json
index a0852eaec575d3f93873a3db190dec4da8fc42dc..f2ee7ce2c3f4d6f9f759876b5d73a16e01a80ff2 100644 (file)
--- a/modules/luci-base/root/usr/share/rpcd/acl.d/luci-base.json
+++ b/modules/luci-base/root/usr/share/rpcd/acl.d/luci-base.json
@@ -23,6 +23,7 @@
                        "file": {
                                "/": [ "list" ],
                                "/*": [ "list" ],
+                               "/etc/rc.local": [ "read" ],
                                "/proc/sys/kernel/hostname": [ "read" ]
                        },
                        "ubus": {
@@ -39,10 +40,11 @@
                "write": {
                        "cgi-io": [ "upload", "/etc/luci-uploads/*" ],
                        "file": {
-                               "/etc/luci-uploads/*": [ "write" ]
+                               "/etc/luci-uploads/*": [ "write" ],
+                               "/etc/rc.local": [ "write" ]
                        },
                        "ubus": {
-                               "file": [ "remove" ],
+                               "file": [ "write", "remove" ],
                                "iwinfo": [ "scan" ],
                                "luci": [ "setInitAction", "setLocaltime" ],
                                "uci": [ "add", "apply", "confirm", "delete", "order", "set", "rename" ]