Description

When user type "show policy ?" in CLI, Junos wrongly escalated user privilege as user root 


/// Below is the log file to check this behavior in this sample:

set system syslog file test-auth-issue authorization any

set system syslog file test-auth-issue interactive-commands any



/// When user "user1" types "show policy ?) or "show policy R?) for auto-complete, We can see the behavior show up in the logs with user root kicked in


user1@mx960> set cli timestamp

Jun 24 12:02:10

CLI timestamp set to: %b %d %T


{master}

user1@mx960> show policy ?

Jun 24 12:02:18

Possible completions:


 <[Enter]>   Execute this command

 <policy>    Name of policy

 ARBOR-EXPORT

 [,,,]

 conditions   Show conditions used by policy

 damping    Show state of route flap damping

 logical-system  Name of logical system, or 'all'

 rib-sharding   Name of rib shard

 statistics   Statistics for policy

 |     Pipe through a command


{master}

user1@mx960> show policy REJECT-ALL (hit <tab> after 'J' to autocomplete)

Jun 24 12:02:33

Policy REJECT-ALL: [RESOLVED/]

 Term REJECT-ALL:

  then reject


{master}

user1@mx960> 


/// User1 Authenticated and typed command set cli timestamp


Jun 24 12:01:58 mx960 mgd[37209]: UI_AUTH_EVENT: Authenticated user 'user1' assigned to class 'j-super-user'

Jun 24 12:01:58 mx960 mgd[37209]: UI_LOGIN_EVENT: User 'user1' login, class 'j-super-user' [37209], ssh-connection '<SRC-IP> 57596 10.0.121.1 22', client-mode 'cli'

Jun 24 12:02:10 mx960 mgd[37209]: UI_CMDLINE_READ_LINE: User 'user1', command 'set cli timestamp '


///[This is where we requested help with: show policy ?]  - Wrongly Authenticated as user root now.


Jun 24 12:02:19 mx960 mgd[37311]: UI_AUTH_EVENT: Authenticated user 'root' assigned to class 'super-user' <<<==escalated privilege as user root

Jun 24 12:02:19 mx960 mgd[37311]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [37311], ssh-connection '<SRC-IP> 57596 10.0.121.1 22', client-mode 'cli'

Jun 24 12:02:19 mx960 mgd[37311]: UI_CMDLINE_READ_LINE: User 'root', command 'show policy '

Jun 24 12:02:19 mx960 mgd[37311]: UI_LOGOUT_EVENT: User 'root' logout


/// [This is where we autocompleted with: show policy REJ<tab>]  - - Wrongly Authenticated as user root now.


Jun 24 12:02:27 mx960 mgd[37375]: UI_AUTH_EVENT: Authenticated user 'root' assigned to class 'super-user' <<<==escalated privilege as user root

Jun 24 12:02:27 mx960 mgd[37375]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [37375], ssh-connection '<SRC-IP> 57596 10.0.121.1 22', client-mode 'cli'

Jun 24 12:02:27 mx960 mgd[37375]: UI_CMDLINE_READ_LINE: User 'root', command 'show policy '

Jun 24 12:02:27 mx960 mgd[37375]: UI_LOGOUT_EVENT: User 'root' logout


/// Back at CLI in user1 context with 'show policy REJECT-ALL' as the active string


Jun 24 12:02:33 mx960 mgd[37209]: UI_CMDLINE_READ_LINE: User 'user1', command 'show policy REJECT-ALL '

Jun 24 12:02:38 mx960 mgd[37209]: UI_CMDLINE_READ_LINE: User 'user1', command 'quit '

Jun 24 12:02:38 mx960 mgd[37209]: UI_LOGOUT_EVENT: User 'user1' logout

Symptoms


Solution

This is fixed through PR1965924 - Junos escalated user privilege as user root, returns the help info or autocompletion When trying to get help for a command


Modification History

2026-09-14 : Article Created