LuCI2如何进行权限管理
在openwrt中，LuCI和LuCI2都是通过rpcd的acl来完成权限管理的。
- 在“/usr/share/rpcd/acl.d/”目录中会存在”*.json”文件定义不同的访问权限级别
- 在“/etc/config/rpcd”文件中定义了不同用户对应的访问权限级别；
例如：
|
config login option username 'root' option password '$p$root' list read '*' list write '*'
config login option username 'blaer' option password '$p$blaer' list read lesssuperuser list write lesssuperuser
|
在上面的“/etc/config/rpcd”文件中定义了两个用户的访问权限：
- “root”用户可以读写一切
- “blaer”用户对应lesssuperuser权限级别。而lesssuperuser权限级别在“/usr/share/rpcd/acl.d/”目录中的某个”*.json”文件中定义；
例如lesssuperuser权限级别定义如下：
|
{ "lesssuperuser": { "description": "not quite as super user", "read": { "ubus": { "file": [ "*" ], "log": [ "*" ], "service": [ "*" ], }, }, "write": { "ubus": { "file": [ "*" ], "log": [ "*" ], "service": [ "*" ], }, } } }
|
而一个超级用户可能的权限定义如下：
|
{ "superuser": { "description": "Super user access role", "read": { "ubus": { "*": [ "*" ] }, "uci": [ "*" ] }, "write": { "ubus": { "*": [ "*" ] }, "uci": [ "*" ] } } }
|
虽然ubus有一个uci方法，但是使用ubus作用域时，只能指定某个“uci set”是允许还是不允许，但不能指定它是否允许修改某个文件，例如，允许修改/etc/config/system，而不允许/etc/ config/network；
而使用（"uci": [ "*" ]）可以让你来指定”/etc/config/”目录中某个文件的读写权限；
我们看一个luci2中定义的更复杂的权限
| 在/usr/share/rpcd/acl.d/luci2.json中根据功能划分定义了一组不同的访问权限规则，内容比较多只摘抄一部分； { "unauthenticated": { "description": "Functions allowed for unauthenticated requests", "read": { "ubus": { "luci2.ui": [ "themes" ] } } },
"core": { "description": "Core functions for LuCI", "read": { "ubus": { "luci2.ui": [ "*" ], "session": [ "access", "destroy" ], "uci": [ "*" ] } } },
"status": { "description": "Status information display", "read": { "ubus": { "iwinfo": [ "devices", "info", "assoclist", "phyname" ], "system": [ "info", "board" ], "network.interface": [ "status" ], "luci2.network": [ "conntrack_count", "dhcp_leases", "dhcp6_leases", "arp_table", "routes", "routes6" ], "luci2.system": [ "diskfree", "syslog", "dmesg", "process_list" ] } }, "write": { "ubus": { "luci2.system": [ "process_signal" ] } } },
"system": { "description": "General system settings", "read": { "ubus": { "system": [ "info", "board" ], "luci2.system": [ "init_list" ] }, "uci": [ "luci" ] }, "write": { "ubus": { "luci2.system": [ "init_action" ] }, "uci": [ "luci" ] } },
"admin": { "description": "Authentication and SSH settings", "read": { "ubus": { "luci2.system": [ "sshkeys_get" ] }, "uci": [ "dropbear" ] }, "write": { "ubus": { "luci2.system": [ "sshkeys_set", "password_set" ] }, "uci": [ "dropbear" ] } },
"users": { "description": "Guest login settings", "read": { "uci": [ "rpcd" ] }, "write": { "uci": [ "rpcd" ] } },
"software": { "description": "Package management", "read": { "ubus": { "system": [ "info", "board" ], "luci2.opkg": [ "list", "list_installed", "find", "config_get" ] } }, "write": { "ubus": { "luci2.opkg": [ "install", "remove", "update", "config_set" ] } } },
"upgrade": { "description": "Firmware upgrade", "read": { "ubus": { "luci2.system": [ "upgrade_test", "reset_test" ] } }, "write": { "luci-io": [ "upload" ], "ubus": { "luci2.system": [ "upgrade_start", "upgrade_clean", "reset_start", "reboot" ] } } },
针对上面的权限规则，我们可以定义如下的rpcd配置文件为不同的用户配置不同的访问权限 # cat /etc/config/rpcd
config login option username 'adminxps' option password '$p$adminxps' list read '*' list write 'core' list write 'status' list write 'system' list write 'software' list write 'upgrade'
|
从上面的配置文件，我们知道，
- adminxps这个用户可以读所有的东西；
- 但是对于写权限来说，它只能处理“core/status/system/software/upgrade”这几个权限规则; "/usr/share/rpcd/acl.d/luci2.json"中定义的“users”这个规则，adminxps这个用户就没有写权限；
当然如果系统有多个用户的话，你可以对不同用户类似地配置不同的访问权限；例如管理员用户有最高权限，可以读写一切；而其他用户则只能读写部分属性；