modules/luci-mod-status/root/usr/share/rpcd/acl.d/luci-mod-status.json

   1 {
   2         "luci-mod-status-realtime": {
   3                 "description": "Grant access to realtime statistics",
   4                 "read": {
   5                         "ubus": {
   6                                 "luci": [ "getConntrackList", "getRealtimeStats" ],
   7                                 "network.rrdns": [ "lookup" ]
   8                         }
   9                 }
  10         },
  11
  12         "luci-mod-status-processes": {
  13                 "description": "Grant access to process status",
  14                 "read": {
  15                         "ubus": {
  16                                 "luci": [ "getProcessList" ]
  17                         }
  18                 },
  19                 "write": {
  20                         "file": {
  21                                 "/bin/kill": [ "exec" ]
  22                         },
  23                         "ubus": {
  24                                 "file": [ "exec" ]
  25                         }
  26                 }
  27         },
  28
  29         "luci-mod-status-logs": {
  30                 "description": "Grant access to system logs",
  31                 "read": {
  32                         "cgi-io": [ "exec" ],
  33                         "file": {
  34                                 "/bin/dmesg -r": [ "exec" ],
  35                                 "/sbin/logread": [ "stat" ],
  36                                 "/sbin/logread -e ^": [ "exec" ],
  37                                 "/usr/sbin/logread": [ "stat" ],
  38                                 "/usr/sbin/logread -e ^": [ "exec" ]
  39                         },
  40                         "ubus": {
  41                                 "file": [ "stat" ]
  42                         }
  43                 }
  44         },
  45
  46         "luci-mod-status-routes": {
  47                 "description": "Grant access to routing status",
  48                 "read": {
  49                         "file": {
  50                                 "/sbin/ip -[46] neigh show": [ "exec" ],
  51                                 "/sbin/ip -[46] route show table all": [ "exec" ],
  52                                 "/sbin/ip -[46] rule show": [ "exec" ]
  53                         },
  54                         "ubus": {
  55                                 "file": [ "exec" ]
  56                         }
  57                 }
  58         },
  59
  60         "luci-mod-status-channel_analysis": {
  61                 "description": "Grant access to wireless channel status",
  62                 "read": {
  63                         "ubus": {
  64                                 "iwinfo": [ "info", "freqlist" ]
  65                         }
  66                 }
  67         },
  68
  69         "luci-mod-status-firewall": {
  70                 "description": "Grant access to firewall status",
  71                 "read": {
  72                         "cgi-io": [ "exec" ],
  73                         "file": {
  74                                 "/usr/sbin/nft --terse --json list ruleset": [ "exec" ],
  75                                 "/usr/sbin/iptables --line-numbers -w -nvxL -t *": [ "exec" ],
  76                                 "/usr/sbin/ip6tables --line-numbers -w -nvxL -t *": [ "exec" ],
  77                                 "/usr/sbin/ip6tables": [ "list" ],
  78                                 "/usr/sbin/iptables-save": [ "exec" ],
  79                                 "/usr/sbin/ip6tables-save": [ "exec" ]
  80                         },
  81                         "ubus": {
  82                                 "file": [ "stat" ]
  83                         }
  84                 },
  85                 "write": {
  86                         "cgi-io": [ "exec" ],
  87                         "file": {
  88                                 "/etc/init.d/firewall restart": [ "exec" ],
  89                                 "/usr/sbin/iptables -Z": [ "exec" ],
  90                                 "/usr/sbin/ip6tables -Z": [ "exec" ]
  91                         },
  92                         "ubus": {
  93                                 "file": [ "exec" ]
  94                         }
  95                 }
  96         }
  97 }