🐶 Sync 2026-10-08 01:07:04

luci-app-dockerman/root/usr/share/rpcd/acl.d/luci-app-dockerman.json

@@ -7,8 +7,12 @@
 				"/*": ["list", "read"]
 			},
 			"ubus": {
-				"docker": [ "*" ],
-				"docker.*": [ "*" ],
+				"docker": [ "df", "events", "info", "ping", "version" ],
+				"docker.container": [ "changes", "export", "get_archive", "info", "info_archive", "inspect", "list", "logs", "stats", "top" ],
+				"docker.exec": [ "inspect" ],
+				"docker.image": [ "get", "history", "inspect", "list", "load", "search" ],
+				"docker.network": [ "inspect", "list" ],
+				"docker.volume": [ "inspect", "list" ],
 				"file": [ "*" ],
 				"luci": [ "getMountPoints" ],
 				"network.interface": [ "dump" ],
@@ -18,8 +22,12 @@
 			},
 		"write": {
 			"ubus": {
-				"docker": [ "*" ],
-				"docker.*": [ "*" ],
+				"docker": [ "df", "events", "info", "ping", "version" ],
+				"docker.container": [ "changes", "create", "exec", "export", "get_archive", "info", "info_archive", "inspect", "kill", "list", "logs", "pause", "prune", "put_archive", "rename", "remove", "restart", "resize", "start", "stats", "stop", "top", "unpause", "update", "ttyd_start" ],
+				"docker.exec": [ "inspect", "resize", "start" ],
+				"docker.image": [ "build", "build_prune", "create", "get", "history", "inspect", "list", "load", "prune", "push", "remove", "search", "tag" ],
+				"docker.network": [ "connect", "create", "disconnect", "inspect", "list", "prune", "remove" ],
+				"docker.volume": [ "create", "inspect", "list", "prune", "remove", "update" ],
 				"rc": [ "init" ]
 			},
 			"uci": [ "dockerd" ]

luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc

@@ -309,23 +309,17 @@ function run_ttyd(request) {
 
 	const id = request.args.id || '';
 	const cmd = request.args.cmd || '/bin/sh';
-	const port = request.args.port || 7682;
+	const port = int(request.args.port) || 7682;
 	const uid = request.args.uid || '';
 
-	if (!id) {
-		return { error: 'Container ID is required' };
+	if (!id || !match(id, /^[a-zA-Z0-9][a-zA-Z0-9_.\-]*$/)) {
+		return { error: 'Invalid container ID' };
 	}
 
-	// Strictly validate all user-supplied values before they are interpolated
-	// into a shell command string to prevent command injection.
-	if (!match(id, /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/) ||
-	    !match(`${port}`, /^[0-9]{1,5}$/) || int(port) < 1 || int(port) > 65535 ||
-	    (uid && !match(`${uid}`, /^[a-zA-Z0-9_-]+$/)) ||
-	    !match(cmd, /^[a-zA-Z0-9_\/.\- ]+$/)) {
-		return { error: 'Invalid parameter supplied' };
+	if (port < 1 || port > 65535) {
+		return { error: 'Invalid port number' };
 	}
 
-	let ttyd_cmd = `ttyd -q -d 2 --once --writable -p ${port} docker`;
 	const sock_addr = ds.get_socket_dest();
 
 	/* Build the full command:
@@ -336,20 +330,28 @@ function run_ttyd(request) {
 	Note: invocations of docker -H x.x.x.x:2375 [..] will fail after v27 without --tls*
 	*/
 	const sock_str = index(sock_addr, '/') != -1 && index(sock_addr, 'unix://') == -1 ? 'unix://' + sock_addr : sock_addr;
-	ttyd_cmd = `${ttyd_cmd} -H "${sock_str}" exec -it`;
+
+	// Stop any existing ttyd
+	system(['start-stop-daemon', '-K', '-q', '-x', '/usr/bin/ttyd']);
+
+	// Build ttyd argv
+	let ttyd_argv = [
+		'-q', '-d', '2', '--once', '--writable',
+		'-p', port,
+		'/usr/bin/docker', '-H', sock_str, 'exec', '-it'
+	];
 	if (uid && uid !== '') {
-		ttyd_cmd = `${ttyd_cmd} -u ${uid}`;
+		push(ttyd_argv, '-u', uid);
 	}
+	push(ttyd_argv, id, cmd);
 
-	ttyd_cmd = `${ttyd_cmd} ${id} ${cmd} &`;
+	// Start ttyd as background daemon
+	let start_cmd = ['start-stop-daemon', '-S', '-x', '/usr/bin/ttyd', '-a', 'ttyd', '-b', '--'];
+	for (let arg in ttyd_argv)
+		push(start_cmd, arg);
+	system(start_cmd);
 
-	// Try to kill any existing ttyd processes on this port
-	system(`pkill -f "ttyd.*-p ${port}"` + ' 2>/dev/null; true');
-
-	// Start ttyd
-	system(ttyd_cmd);
-
-	return { status: 'ttyd started', command: ttyd_cmd };
+	return { status: 'ttyd started' };
 }
 
 // https://docs.docker.com/reference/api/engine/version/v1.47/