modules/luci-base/root/usr/share/rpcd/acl.d/luci-base.json

   1 {
   2         "unauthenticated": {
   3                 "description": "Allow system feature probing",
   4                 "read": {
   5                         "ubus": {
   6                                 "luci": [ "getFeatures" ]
   7                         }
   8                 }
   9         },
  10
  11         "uci-access": {
  12                 "description": "Grant uci write access to all configurations",
  13                 "read": {
  14                         "uci": [ "*" ]
  15                 },
  16                 "write": {
  17                         "uci": [ "*" ]
  18                 }
  19         },
  20         "luci-access": {
  21                 "description": "Grant access to basic LuCI procedures",
  22                 "read": {
  23                         "file": {
  24                                 "/": [ "list" ],
  25                                 "/*": [ "list" ],
  26                                 "/etc/crontabs/root": [ "read" ],
  27                                 "/etc/dropbear/authorized_keys": [ "read" ],
  28                                 "/etc/filesystems": [ "read" ],
  29                                 "/etc/rc.local": [ "read" ],
  30                                 "/proc/filesystems": [ "read" ],
  31                                 "/proc/sys/kernel/hostname": [ "read" ]
  32                         },
  33                         "ubus": {
  34                                 "file": [ "list", "read", "stat" ],
  35                                 "iwinfo": [ "assoclist", "freqlist", "txpowerlist", "countrylist" ],
  36                                 "luci": [ "getBoardJSON", "getDUIDHints", "getHostHints", "getIfaddrs", "getInitList", "getLocaltime", "getTimezones", "getDHCPLeases", "getLEDs", "getNetworkDevices", "getUSBDevices", "getWirelessDevices", "getSwconfigFeatures", "getSwconfigPortState", "getBlockDevices", "getMountPoints" ],
  37                                 "network.device": [ "status" ],
  38                                 "network.interface": [ "dump" ],
  39                                 "network": [ "get_proto_handlers" ],
  40                                 "uci": [ "changes", "get" ]
  41                         },
  42                         "uci": [ "*" ]
  43                 },
  44                 "write": {
  45                         "cgi-io": [ "upload", "/etc/luci-uploads/*" ],
  46                         "file": {
  47                                 "/etc/crontabs/root": [ "write" ],
  48                                 "/etc/dropbear/authorized_keys": [ "write" ],
  49                                 "/etc/luci-uploads/*": [ "write" ],
  50                                 "/etc/rc.local": [ "write" ],
  51                                 "/sbin/block": [ "exec" ]
  52                         },
  53                         "ubus": {
  54                                 "file": [ "write", "remove", "exec" ],
  55                                 "iwinfo": [ "scan" ],
  56                                 "luci": [ "setInitAction", "setLocaltime", "setPassword", "setBlockDetect", "setUmount" ],
  57                                 "uci": [ "add", "apply", "confirm", "delete", "order", "set", "rename" ]
  58                         },
  59                         "uci": [ "*" ]
  60                 }
  61         },
  62         "luci-app-firewall": {
  63                 "description": "Grant access to firewall procedures",
  64                 "read": {
  65                         "ubus": {
  66                                 "luci": [ "getConntrackHelpers" ]
  67                         },
  68                         "uci": [ "firewall" ]
  69                 },
  70                 "write": {
  71                         "uci": [ "firewall" ]
  72                 }
  73         }
  74 }