[pbs-devel] [RFC PATCH proxmox-backup] server/rest: disallow non-protected api calls in privileged environment

[Dominik Csapak]

to prevent potential abuse of non-protected api calls as root

Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
---
this is a rather theoretical security improvement, i am not sure if we
want this? it would only guard against an unprotected api call that somehow
allows code execution. this could then be abused to connect to the
daemon and reabuse the same api call, but with root permissions

also if we want this, maybe this would be good to have in pve too?

 src/server/rest.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/server/rest.rs b/src/server/rest.rs
index 9bf494fd..6b170b7f 100644
--- a/src/server/rest.rs
+++ b/src/server/rest.rs
@@ -750,6 +750,9 @@ async fn handle_request(
 
                     let result = if api_method.protected && env_type == RpcEnvironmentType::PUBLIC {
                         proxy_protected_request(api_method, parts, body, peer).await
+                    } else if !api_method.protected && env_type == RpcEnvironmentType::PRIVILEGED {
+                        let err = http_err!(FORBIDDEN, "invalid server request");
+                        return Ok((formatter.format_error)(err));
                     } else {
                         handle_api_request(rpcenv, api_method, formatter, parts, body, uri_param).await
                     };
-- 
2.20.1