vyos-op-run: T7901: skip permission checks if the user is root#47
Merged
sever-sever merged 1 commit intovyos:currentfrom Dec 5, 2025
Merged
Conversation
sever-sever
approved these changes
Dec 4, 2025
Member
sever-sever
left a comment
There was a problem hiding this comment.
Works fine in my tests
Other errors are not related to the fix
root@r14:/home/vyos# show int
Invalid command [show int]: "int" is not a valid argument for command [show]
root@r14:/home/vyos# show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- ----------------- ----------------- ------- ----- ----- -------------
dum0 192.0.2.1/32 9e:a7:c9:85:fb:1d default 1500 u/u
eth0 192.168.122.14/24 52:54:00:8d:67:6e default 1500 u/u
eth1 10.0.0.1/30 52:54:00:f4:d5:cd default 1500 u/u
eth2 - 52:54:00:b5:3a:46 default 1500 u/u
eth3 10.0.3.1/30 52:54:00:6c:c4:3e default 1500 u/u
lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u
::1/128
root@r14:/home/vyos#
root@r14:/home/vyos# ping 127.0.0.1
Internal error: Node with type "tagNode" must not have a <virtualTagNode> child
root@r14:/home/vyos#
root@r14:/home/vyos# exit
exit
vyos@r14:~$ ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.021 ms
^C
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.021/0.021/0.021/0.000 ms
vyos@r14:~$ sudo su
root@r14:/home/vyos#
root@r14:/home/vyos#
root@r14:/home/vyos# ping 127.0.0.1
Internal error: Node with type "tagNode" must not have a <virtualTagNode> child
root@r14:/home/vyos#
root@r14:/home/vyos# /usr/bin/ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.020 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.026 ms
^C
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1042ms
rtt min/avg/max/mdev = 0.020/0.023/0.026/0.003 ms
root@r14:/home/vyos#
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change summary
A user with effective UID 0 is allowed do to everything, so permission checks make no sense in that case. Since root will never normally be in any operator groups, this fixes an issue with non-existent group lookup after
sudo suand similar.Types of changes
Related Task(s)
Related PR(s)
Checklist: