[openwrt-25.12] luci-app-natmap: allow reading status file under /tmp/run

[ragingbulld]

Backport of #8923 to openwrt-25.12.

Root cause: rpcd's file plugin now checks ACL against the real path of symlinks (openwrt/rpcd e37ed9d), so /var/run/natmap/* (resolving to /tmp/run/natmap/*) is rejected and the LuCI status view shows none on 25.12.5.

Fix: add /tmp/run/natmap/* to the read ACL.

Ref: heiher/natmap#134

[openwrt-ai]

Commit checks

• 02e2286 "luci-app-natmap: allow reading status under /tmp/run" — the (cherry picked from commit f4c8d21a5660dfe228a1910d7213801f28d6276c) trailer points at the head commit of #8923, which is still open and unmerged. f4c8d21a is not reachable from master: the most recent commit touching this ACL file on master is still cc01c0b "luci-app-natmap: add new package" from 2022. Once #8923 is merged the resulting master SHA will very likely differ from the PR head SHA, leaving this trailer pointing at a commit that does not exist on master. CONTRIBUTING.md asks that release branches only receive cherry-picks of fixes, which presumes the master commit landed first — suggest re-running git cherry-pick -x <merged-master-sha> and force-pushing this branch after #8923 lands.

---

The diff itself checks out; no issues found in the change:

• Byte-identical to the upstream commit. The single hunk matches f4c8d21a exactly (2 additions, 1 deletion, same file), and the pre-image on openwrt-25.12 is identical to the one on master, so no rebase divergence.
• Root cause confirmed. rpc_check_symlink_access() in rpcd file.c re-runs rpc_file_access() against the realpath()-resolved target and returns EACCES when the resolved path is not covered, exactly as described.
• Backend path verified. natmap writes its status to /var/run/natmap/$PPID.json, so the granted glob matches what the daemon actually produces.
• Matches the established in-tree pattern for this class of fix already on openwrt-25.12 — b1e84f4 (adblock), 12b2260 (banip), 96c588b (travelmate), 58d43e5 (/proc paths): add the resolved /tmp/run counterpart while keeping the /var/run entry for targets where /var is a real directory.

Two things those sibling commits also needed, which correctly do not apply here:

• No PKG_RELEASE bump — unlike adblock/banip/travelmate, luci-app-natmap's Makefile sets no PKG_VERSION, so luci.mk falls back to the git-derived PKG_SRC_VERSION and the package version advances on its own.
• No additional "list" grant — the sibling apps needed it because file.stat is authorized under list, but natmap.js only calls fs.read() (single fs. call site, line 33), never fs.stat()/fs.list().

---

Generated by Claude Code

[heiher]

@ragingbulld Could you force-update the cherry-pick reference in the commit message to match the original commit in the main branch?

[ragingbulld]

Done — I force-updated this PR and the openwrt-24.10 backport (#8925) so their cherry-pick trailers now reference the commit as merged on master (7a1fc2886fff96468040b77a561a78c91b368157). Thanks for pointing this out!

[heiher]

LGTM. Thanks!

[openwrt-ai]

Reviewed 1 new commit; no new issues found.

The trailer issue from my previous review is resolved: (cherry picked from commit 7a1fc2886fff96468040b77a561a78c91b368157) now points at a commit that is reachable from master (7a1fc28), and the backported hunk is byte-identical to it (same pre-/post-image blobs, ccaee88 → a297537). No divergence introduced by the backport, and no prerequisite commits are missing. CI on 7a7f01d is green.

---

Generated by Claude Code