[pbs-devel] [PATCH proxmox-backup] fix #3014: allow DataStoreAdmins to list DS config
Fabian Grünbichler
f.gruenbichler at proxmox.com
Fri Sep 18 11:45:11 CEST 2020
filtered by those they are privileged enough to read individually. this
allows such users to configure prune/GC schedules via the GUI (the API
already allowed it previously).
permission-wise, a user with this privilege can already:
- list all stores they have access to (returns just name/comment)
- read the config of each store they have access to individually
(returns full config of that datastore + digest of whole config)
but combines them to
- read configs of all datastores they have access to (returns full
config of those datastores + digest of whole config)
user that have AUDIT on just /datastore without propagate can now no
longer read all configurations (but this could be added it back, it just
seems to make little sense to me).
Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---
src/api2/config/datastore.rs | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/src/api2/config/datastore.rs b/src/api2/config/datastore.rs
index 1ee303f8..0f4021d6 100644
--- a/src/api2/config/datastore.rs
+++ b/src/api2/config/datastore.rs
@@ -9,6 +9,7 @@ use proxmox::tools::fs::open_file_locked;
use crate::api2::types::*;
use crate::backup::*;
+use crate::config::cached_user_info::CachedUserInfo;
use crate::config::datastore::{self, DataStoreConfig, DIR_NAME_SCHEMA};
use crate::config::acl::{PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_MODIFY};
@@ -22,7 +23,7 @@ use crate::config::acl::{PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_MODIFY};
items: { type: datastore::DataStoreConfig },
},
access: {
- permission: &Permission::Privilege(&["datastore"], PRIV_DATASTORE_AUDIT, false),
+ permission: &Permission::Anybody,
},
)]
/// List all datastores
@@ -33,11 +34,18 @@ pub fn list_datastores(
let (config, digest) = datastore::config()?;
- let list = config.convert_to_typed_array("datastore")?;
+ let userid: Userid = rpcenv.get_user().unwrap().parse()?;
+ let user_info = CachedUserInfo::new()?;
rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
- Ok(list)
+ let list:Vec<DataStoreConfig> = config.convert_to_typed_array("datastore")?;
+ let filter_by_privs = |store: &DataStoreConfig| {
+ let user_privs = user_info.lookup_privs(&userid, &["datastore", &store.name]);
+ (user_privs & PRIV_DATASTORE_AUDIT) != 0
+ };
+
+ Ok(list.into_iter().filter(filter_by_privs).collect())
}
--
2.20.1
More information about the pbs-devel
mailing list