treewide: stage ACL rules for legacy applications

Fixes: #3866
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

54 files changed, 589 insertions, 2 deletions

diff --git a/applications/luci-app-ahcp/root/usr/share/rpcd/acl.d/luci-app-ahcp.json b/applications/luci-app-ahcp/root/usr/share/rpcd/acl.d/luci-app-ahcp.json
new file mode 100644
index 0000000000..cdd81347ef
--- /dev/null
+++ b/applications/luci-app-ahcp/root/usr/share/rpcd/acl.d/luci-app-ahcp.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-ahcp": {
+		"description": "Grant UCI access for luci-app-ahcp",
+		"read": {
+			"uci": [ "ahcpd" ]
+		},
+		"write": {
+			"uci": [ "ahcpd" ]
+		}
+	}
+}
diff --git a/applications/luci-app-aria2/root/usr/share/rpcd/acl.d/luci-app-aria2.json b/applications/luci-app-aria2/root/usr/share/rpcd/acl.d/luci-app-aria2.json
new file mode 100644
index 0000000000..891f97c28f
--- /dev/null
+++ b/applications/luci-app-aria2/root/usr/share/rpcd/acl.d/luci-app-aria2.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-aria2": {
+		"description": "Grant UCI access for luci-app-aria2",
+		"read": {
+			"uci": [ "aria2" ]
+		},
+		"write": {
+			"uci": [ "aria2" ]
+		}
+	}
+}
diff --git a/applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json b/applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json
new file mode 100644
index 0000000000..c4472c2035
--- /dev/null
+++ b/applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-banip": {
+		"description": "Grant UCI access for luci-app-banip",
+		"read": {
+			"uci": [ "banip" ]
+		},
+		"write": {
+			"uci": [ "banip" ]
+		}
+	}
+}
diff --git a/applications/luci-app-bcp38/root/usr/share/rpcd/acl.d/luci-app-bcp38.json b/applications/luci-app-bcp38/root/usr/share/rpcd/acl.d/luci-app-bcp38.json
new file mode 100644
index 0000000000..731c4974ea
--- /dev/null
+++ b/applications/luci-app-bcp38/root/usr/share/rpcd/acl.d/luci-app-bcp38.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-bcp38": {
+		"description": "Grant UCI access for luci-app-bcp38",
+		"read": {
+			"uci": [ "bcp38" ]
+		},
+		"write": {
+			"uci": [ "bcp38" ]
+		}
+	}
+}
diff --git a/applications/luci-app-clamav/root/usr/share/rpcd/acl.d/luci-app-clamav.json b/applications/luci-app-clamav/root/usr/share/rpcd/acl.d/luci-app-clamav.json
new file mode 100644
index 0000000000..09d46d08bb
--- /dev/null
+++ b/applications/luci-app-clamav/root/usr/share/rpcd/acl.d/luci-app-clamav.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-clamav": {
+		"description": "Grant UCI access for luci-app-clamav",
+		"read": {
+			"uci": [ "clamav" ]
+		},
+		"write": {
+			"uci": [ "clamav" ]
+		}
+	}
+}
diff --git a/applications/luci-app-commands/root/usr/share/rpcd/acl.d/luci-app-commands.json b/applications/luci-app-commands/root/usr/share/rpcd/acl.d/luci-app-commands.json
new file mode 100644
index 0000000000..45facdfd17
--- /dev/null
+++ b/applications/luci-app-commands/root/usr/share/rpcd/acl.d/luci-app-commands.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-commands": {
+		"description": "Grant UCI access for luci-app-commands",
+		"read": {
+			"uci": [ "luci" ]
+		},
+		"write": {
+			"uci": [ "luci" ]
+		}
+	}
+}
diff --git a/applications/luci-app-coovachilli/root/usr/share/rpcd/acl.d/luci-app-coovachilli.json b/applications/luci-app-coovachilli/root/usr/share/rpcd/acl.d/luci-app-coovachilli.json
new file mode 100644
index 0000000000..a3643b5311
--- /dev/null
+++ b/applications/luci-app-coovachilli/root/usr/share/rpcd/acl.d/luci-app-coovachilli.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-coovachilli": {
+		"description": "Grant UCI access for luci-app-coovachilli",
+		"read": {
+			"uci": [ "coovachilli" ]
+		},
+		"write": {
+			"uci": [ "coovachilli" ]
+		}
+	}
+}
diff --git a/applications/luci-app-cshark/root/usr/share/rpcd/acl.d/luci-app-cshark.json b/applications/luci-app-cshark/root/usr/share/rpcd/acl.d/luci-app-cshark.json
new file mode 100644
index 0000000000..32f5fb6041
--- /dev/null
+++ b/applications/luci-app-cshark/root/usr/share/rpcd/acl.d/luci-app-cshark.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-cshark": {
+		"description": "Grant UCI access for luci-app-cshark",
+		"read": {
+			"uci": [ "cshark" ]
+		},
+		"write": {
+			"uci": [ "cshark" ]
+		}
+	}
+}
diff --git a/applications/luci-app-dawn/root/usr/share/rpcd/acl.d/luci-app-dawn.json b/applications/luci-app-dawn/root/usr/share/rpcd/acl.d/luci-app-dawn.json
new file mode 100644
index 0000000000..4fece64a86
--- /dev/null
+++ b/applications/luci-app-dawn/root/usr/share/rpcd/acl.d/luci-app-dawn.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-dawn": {
+		"description": "Grant UCI access for luci-app-dawn",
+		"read": {
+			"uci": [ "dawn" ]
+		},
+		"write": {
+			"uci": [ "dawn" ]
+		}
+	}
+}
diff --git a/applications/luci-app-dcwapd/root/usr/share/rpcd/acl.d/luci-app-dcwapd.json b/applications/luci-app-dcwapd/root/usr/share/rpcd/acl.d/luci-app-dcwapd.json
new file mode 100644
index 0000000000..07a392a5d5
--- /dev/null
+++ b/applications/luci-app-dcwapd/root/usr/share/rpcd/acl.d/luci-app-dcwapd.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-dcwapd": {
+		"description": "Grant UCI access for luci-app-dcwapd",
+		"read": {
+			"uci": [ "dcwapd" ]
+		},
+		"write": {
+			"uci": [ "dcwapd" ]
+		}
+	}
+}
diff --git a/applications/luci-app-dnscrypt-proxy/root/usr/share/rpcd/acl.d/luci-app-dnscrypt-proxy.json b/applications/luci-app-dnscrypt-proxy/root/usr/share/rpcd/acl.d/luci-app-dnscrypt-proxy.json
new file mode 100644
index 0000000000..020bc217cd
--- /dev/null
+++ b/applications/luci-app-dnscrypt-proxy/root/usr/share/rpcd/acl.d/luci-app-dnscrypt-proxy.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-dnscrypt-proxy": {
+		"description": "Grant UCI access for luci-app-dnscrypt-proxy",
+		"read": {
+			"uci": [ "dhcp", "dnscrypt-proxy" ]
+		},
+		"write": {
+			"uci": [ "dhcp", "dnscrypt-proxy" ]
+		}
+	}
+}
diff --git a/applications/luci-app-dump1090/root/usr/share/rpcd/acl.d/luci-app-dump1090.json b/applications/luci-app-dump1090/root/usr/share/rpcd/acl.d/luci-app-dump1090.json
new file mode 100644
index 0000000000..55fb9fd812
--- /dev/null
+++ b/applications/luci-app-dump1090/root/usr/share/rpcd/acl.d/luci-app-dump1090.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-dump1090": {
+		"description": "Grant UCI access for luci-app-dump1090",
+		"read": {
+			"uci": [ "dump1090" ]
+		},
+		"write": {
+			"uci": [ "dump1090" ]
+		}
+	}
+}
diff --git a/applications/luci-app-dynapoint/root/usr/share/rpcd/acl.d/luci-app-dynapoint.json b/applications/luci-app-dynapoint/root/usr/share/rpcd/acl.d/luci-app-dynapoint.json
new file mode 100644
index 0000000000..2dea0fc185
--- /dev/null
+++ b/applications/luci-app-dynapoint/root/usr/share/rpcd/acl.d/luci-app-dynapoint.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-dynapoint": {
+		"description": "Grant UCI access for luci-app-dynapoint",
+		"read": {
+			"uci": [ "dynapoint", "wireless" ]
+		},
+		"write": {
+			"uci": [ "dynapoint", "wireless" ]
+		}
+	}
+}
diff --git a/applications/luci-app-fwknopd/root/usr/share/rpcd/acl.d/luci-app-fwknopd.json b/applications/luci-app-fwknopd/root/usr/share/rpcd/acl.d/luci-app-fwknopd.json
new file mode 100644
index 0000000000..3877f87526
--- /dev/null
+++ b/applications/luci-app-fwknopd/root/usr/share/rpcd/acl.d/luci-app-fwknopd.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-fwknopd": {
+		"description": "Grant UCI access for luci-app-fwknopd",
+		"read": {
+			"uci": [ "fwknopd" ]
+		},
+		"write": {
+			"uci": [ "fwknopd" ]
+		}
+	}
+}
diff --git a/applications/luci-app-hd-idle/root/usr/share/rpcd/acl.d/luci-app-hd-idle.json b/applications/luci-app-hd-idle/root/usr/share/rpcd/acl.d/luci-app-hd-idle.json
new file mode 100644
index 0000000000..0a48a9ad87
--- /dev/null
+++ b/applications/luci-app-hd-idle/root/usr/share/rpcd/acl.d/luci-app-hd-idle.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-hd-idle": {
+		"description": "Grant UCI access for luci-app-hd-idle",
+		"read": {
+			"uci": [ "hd-idle" ]
+		},
+		"write": {
+			"uci": [ "hd-idle" ]
+		}
+	}
+}
diff --git a/applications/luci-app-https-dns-proxy/root/usr/share/rpcd/acl.d/luci-app-https-dns-proxy.json b/applications/luci-app-https-dns-proxy/root/usr/share/rpcd/acl.d/luci-app-https-dns-proxy.json
new file mode 100644
index 0000000000..0886cc885a
--- /dev/null
+++ b/applications/luci-app-https-dns-proxy/root/usr/share/rpcd/acl.d/luci-app-https-dns-proxy.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-https-dns-proxy": {
+		"description": "Grant UCI access for luci-app-https-dns-proxy",
+		"read": {
+			"uci": [ "https-dns-proxy" ]
+		},
+		"write": {
+			"uci": [ "https-dns-proxy" ]
+		}
+	}
+}
diff --git a/applications/luci-app-ltqtapi/root/usr/share/rpcd/acl.d/luci-app-ltqtapi.json b/applications/luci-app-ltqtapi/root/usr/share/rpcd/acl.d/luci-app-ltqtapi.json
new file mode 100644
index 0000000000..0d4df93a85
--- /dev/null
+++ b/applications/luci-app-ltqtapi/root/usr/share/rpcd/acl.d/luci-app-ltqtapi.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-ltqtapi": {
+		"description": "Grant UCI access for luci-app-ltqtapi",
+		"read": {
+			"uci": [ "telephony" ]
+		},
+		"write": {
+			"uci": [ "telephony" ]
+		}
+	}
+}
diff --git a/applications/luci-app-lxc/root/usr/share/rpcd/acl.d/luci-app-lxc.json b/applications/luci-app-lxc/root/usr/share/rpcd/acl.d/luci-app-lxc.json
new file mode 100644
index 0000000000..9cf9f3ca57
--- /dev/null
+++ b/applications/luci-app-lxc/root/usr/share/rpcd/acl.d/luci-app-lxc.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-lxc": {
+		"description": "Grant UCI access for luci-app-lxc",
+		"read": {
+			"uci": [ "lxc" ]
+		},
+		"write": {
+			"uci": [ "lxc" ]
+		}
+	}
+}
diff --git a/applications/luci-app-mjpg-streamer/root/usr/share/rpcd/acl.d/luci-app-mjpg-streamer.json b/applications/luci-app-mjpg-streamer/root/usr/share/rpcd/acl.d/luci-app-mjpg-streamer.json
new file mode 100644
index 0000000000..ab68a6e1c2
--- /dev/null
+++ b/applications/luci-app-mjpg-streamer/root/usr/share/rpcd/acl.d/luci-app-mjpg-streamer.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-mjpg-streamer": {
+		"description": "Grant UCI access for luci-app-mjpg-streamer",
+		"read": {
+			"uci": [ "mjpg-streamer" ]
+		},
+		"write": {
+			"uci": [ "mjpg-streamer" ]
+		}
+	}
+}
diff --git a/applications/luci-app-mosquitto/root/usr/share/rpcd/acl.d/luci-app-mosquitto.json b/applications/luci-app-mosquitto/root/usr/share/rpcd/acl.d/luci-app-mosquitto.json
new file mode 100644
index 0000000000..dd3c6f7a20
--- /dev/null
+++ b/applications/luci-app-mosquitto/root/usr/share/rpcd/acl.d/luci-app-mosquitto.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-mosquitto": {
+		"description": "Grant UCI access for luci-app-mosquitto",
+		"read": {
+			"uci": [ "mosquitto" ]
+		},
+		"write": {
+			"uci": [ "mosquitto" ]
+		}
+	}
+}
diff --git a/applications/luci-app-mwan3/root/usr/share/rpcd/acl.d/luci-app-mwan3.json b/applications/luci-app-mwan3/root/usr/share/rpcd/acl.d/luci-app-mwan3.json
new file mode 100644
index 0000000000..539ed0fb90
--- /dev/null
+++ b/applications/luci-app-mwan3/root/usr/share/rpcd/acl.d/luci-app-mwan3.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-mwan3": {
+		"description": "Grant UCI access for luci-app-mwan3",
+		"read": {
+			"uci": [ "mwan3" ]
+		},
+		"write": {
+			"uci": [ "mwan3" ]
+		}
+	}
+}
diff --git a/applications/luci-app-nft-qos/root/usr/share/rpcd/acl.d/luci-app-nft-qos.json b/applications/luci-app-nft-qos/root/usr/share/rpcd/acl.d/luci-app-nft-qos.json
new file mode 100644
index 0000000000..b2de6260ba
--- /dev/null
+++ b/applications/luci-app-nft-qos/root/usr/share/rpcd/acl.d/luci-app-nft-qos.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-nft-qos": {
+		"description": "Grant UCI access for luci-app-nft-qos",
+		"read": {
+			"uci": [ "nft-qos" ]
+		},
+		"write": {
+			"uci": [ "nft-qos" ]
+		}
+	}
+}
diff --git a/applications/luci-app-nlbwmon/root/usr/share/rpcd/acl.d/luci-app-nlbwmon.json b/applications/luci-app-nlbwmon/root/usr/share/rpcd/acl.d/luci-app-nlbwmon.json
new file mode 100644
index 0000000000..0ccc5b1c36
--- /dev/null
+++ b/applications/luci-app-nlbwmon/root/usr/share/rpcd/acl.d/luci-app-nlbwmon.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-nlbwmon": {
+		"description": "Grant UCI access for luci-app-nlbwmon",
+		"read": {
+			"uci": [ "nlbwmon" ]
+		},
+		"write": {
+			"uci": [ "nlbwmon" ]
+		}
+	}
+}
diff --git a/applications/luci-app-noddos/root/usr/share/rpcd/acl.d/luci-app-noddos.json b/applications/luci-app-noddos/root/usr/share/rpcd/acl.d/luci-app-noddos.json
new file mode 100644
index 0000000000..1560c39eed
--- /dev/null
+++ b/applications/luci-app-noddos/root/usr/share/rpcd/acl.d/luci-app-noddos.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-noddos": {
+		"description": "Grant UCI access for luci-app-noddos",
+		"read": {
+			"uci": [ "noddos" ]
+		},
+		"write": {
+			"uci": [ "noddos" ]
+		}
+	}
+}
diff --git a/applications/luci-app-ntpc/root/usr/share/rpcd/acl.d/luci-app-ntpc.json b/applications/luci-app-ntpc/root/usr/share/rpcd/acl.d/luci-app-ntpc.json
new file mode 100644
index 0000000000..2b534a9770
--- /dev/null
+++ b/applications/luci-app-ntpc/root/usr/share/rpcd/acl.d/luci-app-ntpc.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-ntpc": {
+		"description": "Grant UCI access for luci-app-ntpc",
+		"read": {
+			"uci": [ "ntpclient" ]
+		},
+		"write": {
+			"uci": [ "ntpclient" ]
+		}
+	}
+}
diff --git a/applications/luci-app-nut/root/usr/share/rpcd/acl.d/luci-app-nut.json b/applications/luci-app-nut/root/usr/share/rpcd/acl.d/luci-app-nut.json
new file mode 100644
index 0000000000..f9abbed338
--- /dev/null
+++ b/applications/luci-app-nut/root/usr/share/rpcd/acl.d/luci-app-nut.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-nut": {
+		"description": "Grant UCI access for luci-app-nut",
+		"read": {
+			"uci": [ "nut_cgi", "nut_monitor", "nut_server" ]
+		},
+		"write": {
+			"uci": [ "nut_cgi", "nut_monitor", "nut_server" ]
+		}
+	}
+}
diff --git a/applications/luci-app-ocserv/root/usr/share/rpcd/acl.d/luci-app-ocserv.json b/applications/luci-app-ocserv/root/usr/share/rpcd/acl.d/luci-app-ocserv.json
new file mode 100644
index 0000000000..fce65d8c70
--- /dev/null
+++ b/applications/luci-app-ocserv/root/usr/share/rpcd/acl.d/luci-app-ocserv.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-ocserv": {
+		"description": "Grant UCI access for luci-app-ocserv",
+		"read": {
+			"uci": [ "ocserv" ]
+		},
+		"write": {
+			"uci": [ "ocserv" ]
+		}
+	}
+}
diff --git a/applications/luci-app-olsr/root/usr/share/rpcd/acl.d/luci-app-olsr.json b/applications/luci-app-olsr/root/usr/share/rpcd/acl.d/luci-app-olsr.json
new file mode 100644
index 0000000000..246afbc941
--- /dev/null
+++ b/applications/luci-app-olsr/root/usr/share/rpcd/acl.d/luci-app-olsr.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-olsr": {
+		"description": "Grant UCI access for luci-app-olsr",
+		"read": {
+			"uci": [ "luci_olsr", "olsrd", "olsrd6" ]
+		},
+		"write": {
+			"uci": [ "luci_olsr", "olsrd", "olsrd6" ]
+		}
+	}
+}
diff --git a/applications/luci-app-openvpn/root/usr/share/rpcd/acl.d/luci-app-openvpn.json b/applications/luci-app-openvpn/root/usr/share/rpcd/acl.d/luci-app-openvpn.json
index bc9d8e184d..41f62ad294 100644
--- a/applications/luci-app-openvpn/root/usr/share/rpcd/acl.d/luci-app-openvpn.json
+++ b/applications/luci-app-openvpn/root/usr/share/rpcd/acl.d/luci-app-openvpn.json
@@ -1,11 +1,15 @@
 {
 	"luci-app-openvpn": {
-		"description": "Grant file upload access to /etc/openvpn",
+		"description": "Grant access to OpenVPN configuration",
+		"read": {
+			"uci": [ "openvpn" ]
+		},
 		"write": {
 			"cgi-io": [ "upload" ],
 			"file": {
 				"/etc/openvpn/*": [ "write" ]
-			}
+			},
+			"uci": [ "openvpn" ]
 		}
 	}
 }
diff --git a/applications/luci-app-p910nd/root/usr/share/rpcd/acl.d/luci-app-p910nd.json b/applications/luci-app-p910nd/root/usr/share/rpcd/acl.d/luci-app-p910nd.json
new file mode 100644
index 0000000000..b2e7476e61
--- /dev/null
+++ b/applications/luci-app-p910nd/root/usr/share/rpcd/acl.d/luci-app-p910nd.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-p910nd": {
+		"description": "Grant UCI access for luci-app-p910nd",
+		"read": {
+			"uci": [ "p910nd" ]
+		},
+		"write": {
+			"uci": [ "p910nd" ]
+		}
+	}
+}
diff --git a/applications/luci-app-polipo/root/usr/share/rpcd/acl.d/luci-app-polipo.json b/applications/luci-app-polipo/root/usr/share/rpcd/acl.d/luci-app-polipo.json
new file mode 100644
index 0000000000..5b9dfa88fa
--- /dev/null
+++ b/applications/luci-app-polipo/root/usr/share/rpcd/acl.d/luci-app-polipo.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-polipo": {
+		"description": "Grant UCI access for luci-app-polipo",
+		"read": {
+			"uci": [ "polipo" ]
+		},
+		"write": {
+			"uci": [ "polipo" ]
+		}
+	}
+}
diff --git a/applications/luci-app-privoxy/root/usr/share/rpcd/acl.d/luci-app-privoxy.json b/applications/luci-app-privoxy/root/usr/share/rpcd/acl.d/luci-app-privoxy.json
new file mode 100644
index 0000000000..6b328a07a4
--- /dev/null
+++ b/applications/luci-app-privoxy/root/usr/share/rpcd/acl.d/luci-app-privoxy.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-privoxy": {
+		"description": "Grant UCI access for luci-app-privoxy",
+		"read": {
+			"uci": [ "privoxy" ]
+		},
+		"write": {
+			"uci": [ "privoxy" ]
+		}
+	}
+}
diff --git a/applications/luci-app-qos/root/usr/share/rpcd/acl.d/luci-app-qos.json b/applications/luci-app-qos/root/usr/share/rpcd/acl.d/luci-app-qos.json
new file mode 100644
index 0000000000..f37a98eeaf
--- /dev/null
+++ b/applications/luci-app-qos/root/usr/share/rpcd/acl.d/luci-app-qos.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-qos": {
+		"description": "Grant UCI access for luci-app-qos",
+		"read": {
+			"uci": [ "qos" ]
+		},
+		"write": {
+			"uci": [ "qos" ]
+		}
+	}
+}
diff --git a/applications/luci-app-radicale/root/usr/share/rpcd/acl.d/luci-app-radicale.json b/applications/luci-app-radicale/root/usr/share/rpcd/acl.d/luci-app-radicale.json
new file mode 100644
index 0000000000..122c85630d
--- /dev/null
+++ b/applications/luci-app-radicale/root/usr/share/rpcd/acl.d/luci-app-radicale.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-radicale": {
+		"description": "Grant UCI access for luci-app-radicale",
+		"read": {
+			"uci": [ "radicale" ]
+		},
+		"write": {
+			"uci": [ "radicale" ]
+		}
+	}
+}
diff --git a/applications/luci-app-radicale2/root/usr/share/rpcd/acl.d/luci-app-radicale2.json b/applications/luci-app-radicale2/root/usr/share/rpcd/acl.d/luci-app-radicale2.json
new file mode 100644
index 0000000000..edb1dbd499
--- /dev/null
+++ b/applications/luci-app-radicale2/root/usr/share/rpcd/acl.d/luci-app-radicale2.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-radicale2": {
+		"description": "Grant UCI access for luci-app-radicale2",
+		"read": {
+			"uci": [ "radicale2" ]
+		},
+		"write": {
+			"uci": [ "radicale2" ]
+		}
+	}
+}
diff --git a/applications/luci-app-rosy-file-server/root/usr/share/rpcd/acl.d/luci-app-rosy-file-server.json b/applications/luci-app-rosy-file-server/root/usr/share/rpcd/acl.d/luci-app-rosy-file-server.json
new file mode 100644
index 0000000000..b5ce1ffa16
--- /dev/null
+++ b/applications/luci-app-rosy-file-server/root/usr/share/rpcd/acl.d/luci-app-rosy-file-server.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-rosy-file-server": {
+		"description": "Grant UCI access for luci-app-rosy-file-server",
+		"read": {
+			"uci": [ "rosyfs" ]
+		},
+		"write": {
+			"uci": [ "rosyfs" ]
+		}
+	}
+}
diff --git a/applications/luci-app-rp-pppoe-server/root/usr/share/rpcd/acl.d/luci-app-rp-pppoe-server.json b/applications/luci-app-rp-pppoe-server/root/usr/share/rpcd/acl.d/luci-app-rp-pppoe-server.json
new file mode 100644
index 0000000000..904faac7c6
--- /dev/null
+++ b/applications/luci-app-rp-pppoe-server/root/usr/share/rpcd/acl.d/luci-app-rp-pppoe-server.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-rp-pppoe-server": {
+		"description": "Grant UCI access for luci-app-rp-pppoe-server",
+		"read": {
+			"uci": [ "pppoe" ]
+		},
+		"write": {
+			"uci": [ "pppoe" ]
+		}
+	}
+}
diff --git a/applications/luci-app-samba/root/usr/share/rpcd/acl.d/luci-app-samba.json b/applications/luci-app-samba/root/usr/share/rpcd/acl.d/luci-app-samba.json
new file mode 100644
index 0000000000..c261084718
--- /dev/null
+++ b/applications/luci-app-samba/root/usr/share/rpcd/acl.d/luci-app-samba.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-samba": {
+		"description": "Grant UCI access for luci-app-samba",
+		"read": {
+			"uci": [ "samba" ]
+		},
+		"write": {
+			"uci": [ "samba" ]
+		}
+	}
+}
diff --git a/applications/luci-app-shairplay/root/usr/share/rpcd/acl.d/luci-app-shairplay.json b/applications/luci-app-shairplay/root/usr/share/rpcd/acl.d/luci-app-shairplay.json
new file mode 100644
index 0000000000..b755d17fb5
--- /dev/null
+++ b/applications/luci-app-shairplay/root/usr/share/rpcd/acl.d/luci-app-shairplay.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-shairplay": {
+		"description": "Grant UCI access for luci-app-shairplay",
+		"read": {
+			"uci": [ "shairplay" ]
+		},
+		"write": {
+			"uci": [ "shairplay" ]
+		}
+	}
+}
diff --git a/applications/luci-app-simple-adblock/root/usr/share/rpcd/acl.d/luci-app-simple-adblock.json b/applications/luci-app-simple-adblock/root/usr/share/rpcd/acl.d/luci-app-simple-adblock.json
new file mode 100644
index 0000000000..8a890532bb
--- /dev/null
+++ b/applications/luci-app-simple-adblock/root/usr/share/rpcd/acl.d/luci-app-simple-adblock.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-simple-adblock": {
+		"description": "Grant UCI access for luci-app-simple-adblock",
+		"read": {
+			"uci": [ "simple-adblock" ]
+		},
+		"write": {
+			"uci": [ "simple-adblock" ]
+		}
+	}
+}
diff --git a/applications/luci-app-snmpd/root/usr/share/rpcd/acl.d/luci-app-snmpd.json b/applications/luci-app-snmpd/root/usr/share/rpcd/acl.d/luci-app-snmpd.json
new file mode 100644
index 0000000000..566e521391
--- /dev/null
+++ b/applications/luci-app-snmpd/root/usr/share/rpcd/acl.d/luci-app-snmpd.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-snmpd": {
+		"description": "Grant UCI access for luci-app-snmpd",
+		"read": {
+			"uci": [ "snmpd" ]
+		},
+		"write": {
+			"uci": [ "snmpd" ]
+		}
+	}
+}
diff --git a/applications/luci-app-splash/root/usr/share/rpcd/acl.d/luci-app-splash.json b/applications/luci-app-splash/root/usr/share/rpcd/acl.d/luci-app-splash.json
new file mode 100644
index 0000000000..49801fb9ac
--- /dev/null
+++ b/applications/luci-app-splash/root/usr/share/rpcd/acl.d/luci-app-splash.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-splash": {
+		"description": "Grant UCI access for luci-app-splash",
+		"read": {
+			"uci": [ "luci_splash" ]
+		},
+		"write": {
+			"uci": [ "luci_splash" ]
+		}
+	}
+}
diff --git a/applications/luci-app-sqm/root/usr/share/rpcd/acl.d/luci-app-sqm.json b/applications/luci-app-sqm/root/usr/share/rpcd/acl.d/luci-app-sqm.json
new file mode 100644
index 0000000000..583a54ae5a
--- /dev/null
+++ b/applications/luci-app-sqm/root/usr/share/rpcd/acl.d/luci-app-sqm.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-sqm": {
+		"description": "Grant UCI access for luci-app-sqm",
+		"read": {
+			"uci": [ "sqm" ]
+		},
+		"write": {
+			"uci": [ "sqm" ]
+		}
+	}
+}
diff --git a/applications/luci-app-squid/root/usr/share/rpcd/acl.d/luci-app-squid.json b/applications/luci-app-squid/root/usr/share/rpcd/acl.d/luci-app-squid.json
new file mode 100644
index 0000000000..91f8b5b348
--- /dev/null
+++ b/applications/luci-app-squid/root/usr/share/rpcd/acl.d/luci-app-squid.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-squid": {
+		"description": "Grant UCI access for luci-app-squid",
+		"read": {
+			"uci": [ "squid" ]
+		},
+		"write": {
+			"uci": [ "squid" ]
+		}
+	}
+}
diff --git a/applications/luci-app-tinyproxy/root/usr/share/rpcd/acl.d/luci-app-tinyproxy.json b/applications/luci-app-tinyproxy/root/usr/share/rpcd/acl.d/luci-app-tinyproxy.json
new file mode 100644
index 0000000000..db72bebef5
--- /dev/null
+++ b/applications/luci-app-tinyproxy/root/usr/share/rpcd/acl.d/luci-app-tinyproxy.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-tinyproxy": {
+		"description": "Grant UCI access for luci-app-tinyproxy",
+		"read": {
+			"uci": [ "tinyproxy" ]
+		},
+		"write": {
+			"uci": [ "tinyproxy" ]
+		}
+	}
+}
diff --git a/applications/luci-app-travelmate/root/usr/share/rpcd/acl.d/luci-app-travelmate.json b/applications/luci-app-travelmate/root/usr/share/rpcd/acl.d/luci-app-travelmate.json
new file mode 100644
index 0000000000..a66bc8add6
--- /dev/null
+++ b/applications/luci-app-travelmate/root/usr/share/rpcd/acl.d/luci-app-travelmate.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-travelmate": {
+		"description": "Grant UCI access for luci-app-travelmate",
+		"read": {
+			"uci": [ "travelmate" ]
+		},
+		"write": {
+			"uci": [ "travelmate" ]
+		}
+	}
+}
diff --git a/applications/luci-app-udpxy/root/usr/share/rpcd/acl.d/luci-app-udpxy.json b/applications/luci-app-udpxy/root/usr/share/rpcd/acl.d/luci-app-udpxy.json
new file mode 100644
index 0000000000..c8aacef953
--- /dev/null
+++ b/applications/luci-app-udpxy/root/usr/share/rpcd/acl.d/luci-app-udpxy.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-udpxy": {
+		"description": "Grant UCI access for luci-app-udpxy",
+		"read": {
+			"uci": [ "udpxy" ]
+		},
+		"write": {
+			"uci": [ "udpxy" ]
+		}
+	}
+}
diff --git a/applications/luci-app-uhttpd/root/usr/share/rpcd/acl.d/luci-app-uhttpd.json b/applications/luci-app-uhttpd/root/usr/share/rpcd/acl.d/luci-app-uhttpd.json
new file mode 100644
index 0000000000..d3b93523cc
--- /dev/null
+++ b/applications/luci-app-uhttpd/root/usr/share/rpcd/acl.d/luci-app-uhttpd.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-uhttpd": {
+		"description": "Grant UCI access for luci-app-uhttpd",
+		"read": {
+			"uci": [ "uhttpd" ]
+		},
+		"write": {
+			"uci": [ "uhttpd" ]
+		}
+	}
+}
diff --git a/applications/luci-app-unbound/root/usr/share/rpcd/acl.d/luci-app-unbound.json b/applications/luci-app-unbound/root/usr/share/rpcd/acl.d/luci-app-unbound.json
new file mode 100644
index 0000000000..60779023ac
--- /dev/null
+++ b/applications/luci-app-unbound/root/usr/share/rpcd/acl.d/luci-app-unbound.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-unbound": {
+		"description": "Grant UCI access for luci-app-unbound",
+		"read": {
+			"uci": [ "unbound" ]
+		},
+		"write": {
+			"uci": [ "unbound" ]
+		}
+	}
+}
diff --git a/applications/luci-app-vnstat/root/usr/share/rpcd/acl.d/luci-app-vnstat.json b/applications/luci-app-vnstat/root/usr/share/rpcd/acl.d/luci-app-vnstat.json
new file mode 100644
index 0000000000..01d4134c4e
--- /dev/null
+++ b/applications/luci-app-vnstat/root/usr/share/rpcd/acl.d/luci-app-vnstat.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-vnstat": {
+		"description": "Grant UCI access for luci-app-vnstat",
+		"read": {
+			"uci": [ "vnstat" ]
+		},
+		"write": {
+			"uci": [ "vnstat" ]
+		}
+	}
+}
diff --git a/applications/luci-app-vpn-policy-routing/root/usr/share/rpcd/acl.d/luci-app-vpn-policy-routing.json b/applications/luci-app-vpn-policy-routing/root/usr/share/rpcd/acl.d/luci-app-vpn-policy-routing.json
new file mode 100644
index 0000000000..64e73de9cc
--- /dev/null
+++ b/applications/luci-app-vpn-policy-routing/root/usr/share/rpcd/acl.d/luci-app-vpn-policy-routing.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-vpn-policy-routing": {
+		"description": "Grant UCI access for luci-app-vpn-policy-routing",
+		"read": {
+			"uci": [ "vpn-policy-routing" ]
+		},
+		"write": {
+			"uci": [ "vpn-policy-routing" ]
+		}
+	}
+}
diff --git a/applications/luci-app-vpnbypass/root/usr/share/rpcd/acl.d/luci-app-vpnbypass.json b/applications/luci-app-vpnbypass/root/usr/share/rpcd/acl.d/luci-app-vpnbypass.json
new file mode 100644
index 0000000000..219307e477
--- /dev/null
+++ b/applications/luci-app-vpnbypass/root/usr/share/rpcd/acl.d/luci-app-vpnbypass.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-vpnbypass": {
+		"description": "Grant UCI access for luci-app-vpnbypass",
+		"read": {
+			"uci": [ "dhcp", "vpnbypass" ]
+		},
+		"write": {
+			"uci": [ "dhcp", "vpnbypass" ]
+		}
+	}
+}
diff --git a/applications/luci-app-watchcat/root/usr/share/rpcd/acl.d/luci-app-watchcat.json b/applications/luci-app-watchcat/root/usr/share/rpcd/acl.d/luci-app-watchcat.json
new file mode 100644
index 0000000000..29de34b6d3
--- /dev/null
+++ b/applications/luci-app-watchcat/root/usr/share/rpcd/acl.d/luci-app-watchcat.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-watchcat": {
+		"description": "Grant UCI access for luci-app-watchcat",
+		"read": {
+			"uci": [ "system" ]
+		},
+		"write": {
+			"uci": [ "system" ]
+		}
+	}
+}
diff --git a/applications/luci-app-wifischedule/root/usr/share/rpcd/acl.d/luci-app-wifischedule.json b/applications/luci-app-wifischedule/root/usr/share/rpcd/acl.d/luci-app-wifischedule.json
new file mode 100644
index 0000000000..df44e7c39e
--- /dev/null
+++ b/applications/luci-app-wifischedule/root/usr/share/rpcd/acl.d/luci-app-wifischedule.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-wifischedule": {
+		"description": "Grant UCI access for luci-app-wifischedule",
+		"read": {
+			"uci": [ "wifi_schedule" ]
+		},
+		"write": {
+			"uci": [ "wifi_schedule" ]
+		}
+	}
+}