According to https://docs.vyos.io/en/1.5/automation/command-scripting.html#executing-pre-hooks-post-hooks-scripts you can create two additional directories to run stuff pre/post commits:
/config/scripts/commit/pre-hooks.d /config/scripts/commit/post-hooks.d
Today I applied the security advistory regarding CVE-2026-98432 as described in:
It turns out that you cannot have an fileextension for the scripts placed in pre/post-hooks.d directory?
That is the advisory is correctly written to create a file without fileextension but I prefer to name my scripts to be *.sh.
The root cause for this seems to be that /bin/run-parts wont recognise such files.
I assume the fix might be to add a properly configured --regex=PATTERN to also include scripts who ends with .sh for the /bin/run-parts commands in vyos-user-postcommit-hooks.sh?
That is both files without any fileextension aswell as files with fileextension being .sh should be recognised by run-parts.
root@vyos:~# ls -la /config/scripts/commit/post-hooks.d total 12 drwxr-sr-x 2 vyos vyattacfg 4096 Nov 6 11:54 . drwxr-sr-x 3 vyos vyattacfg 4096 Nov 6 09:21 .. -rwxr-xr-x 1 vyos vyattacfg 593 Nov 6 09:22 cve-2026-98432.sh root@vyos:~# /bin/run-parts --list /config/scripts/commit/post-hooks.d root@vyos:~# mv /config/scripts/commit/post-hooks.d/cve-2026-98432.sh /config/scripts/commit/post-hooks.d/cve-2026-98432 root@vyos:~# ls -la /config/scripts/commit/post-hooks.d total 12 drwxr-sr-x 2 vyos vyattacfg 4096 Nov 6 11:55 . drwxr-sr-x 3 vyos vyattacfg 4096 Nov 6 09:21 .. -rwxr-xr-x 1 vyos vyattacfg 593 Nov 6 09:22 cve-2026-98432 root@vyos:~# /bin/run-parts --list /config/scripts/commit/post-hooks.d /config/scripts/commit/post-hooks.d/cve-2026-98432
As you can see above run-parts as runned by vyos-user-postcommit-hooks.sh doesnt recognise scripts placed in /config/scripts/commit/post-hooks.d ending with *.sh.
Currently only scripts without any fileextension are recognised (and runned).