2f80fe3767
Do not expose the iptables status page as menu item when nftables is present on the system. Instead add a warning banner to the nftables status page directing the user to the hidden iptables status page when we encounter legacy rules on the system. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
97 lines
2 KiB
JSON
97 lines
2 KiB
JSON
{
|
|
"luci-mod-status-realtime": {
|
|
"description": "Grant access to realtime statistics",
|
|
"read": {
|
|
"ubus": {
|
|
"luci": [ "getConntrackList", "getRealtimeStats" ],
|
|
"network.rrdns": [ "lookup" ]
|
|
}
|
|
}
|
|
},
|
|
|
|
"luci-mod-status-processes": {
|
|
"description": "Grant access to process status",
|
|
"read": {
|
|
"ubus": {
|
|
"luci": [ "getProcessList" ]
|
|
}
|
|
},
|
|
"write": {
|
|
"file": {
|
|
"/bin/kill": [ "exec" ]
|
|
},
|
|
"ubus": {
|
|
"file": [ "exec" ]
|
|
}
|
|
}
|
|
},
|
|
|
|
"luci-mod-status-logs": {
|
|
"description": "Grant access to system logs",
|
|
"read": {
|
|
"cgi-io": [ "exec" ],
|
|
"file": {
|
|
"/bin/dmesg -r": [ "exec" ],
|
|
"/sbin/logread": [ "stat" ],
|
|
"/sbin/logread -e ^": [ "exec" ],
|
|
"/usr/sbin/logread": [ "stat" ],
|
|
"/usr/sbin/logread -e ^": [ "exec" ]
|
|
},
|
|
"ubus": {
|
|
"file": [ "stat" ]
|
|
}
|
|
}
|
|
},
|
|
|
|
"luci-mod-status-routes": {
|
|
"description": "Grant access to routing status",
|
|
"read": {
|
|
"file": {
|
|
"/sbin/ip -[46] neigh show": [ "exec" ],
|
|
"/sbin/ip -[46] route show table all": [ "exec" ],
|
|
"/sbin/ip -[46] rule show": [ "exec" ]
|
|
},
|
|
"ubus": {
|
|
"file": [ "exec" ]
|
|
}
|
|
}
|
|
},
|
|
|
|
"luci-mod-status-channel_analysis": {
|
|
"description": "Grant access to wireless channel status",
|
|
"read": {
|
|
"ubus": {
|
|
"iwinfo": [ "info", "freqlist" ]
|
|
}
|
|
}
|
|
},
|
|
|
|
"luci-mod-status-firewall": {
|
|
"description": "Grant access to firewall status",
|
|
"read": {
|
|
"cgi-io": [ "exec" ],
|
|
"file": {
|
|
"/usr/sbin/nft --json list ruleset": [ "exec" ],
|
|
"/usr/sbin/iptables --line-numbers -w -nvxL -t *": [ "exec" ],
|
|
"/usr/sbin/ip6tables --line-numbers -w -nvxL -t *": [ "exec" ],
|
|
"/usr/sbin/ip6tables": [ "list" ],
|
|
"/usr/sbin/iptables-save": [ "exec" ],
|
|
"/usr/sbin/ip6tables-save": [ "exec" ]
|
|
},
|
|
"ubus": {
|
|
"file": [ "stat" ]
|
|
}
|
|
},
|
|
"write": {
|
|
"cgi-io": [ "exec" ],
|
|
"file": {
|
|
"/etc/init.d/firewall restart": [ "exec" ],
|
|
"/usr/sbin/iptables -Z": [ "exec" ],
|
|
"/usr/sbin/ip6tables -Z": [ "exec" ]
|
|
},
|
|
"ubus": {
|
|
"file": [ "exec" ]
|
|
}
|
|
}
|
|
}
|
|
}
|