[pve-devel] [RFC qemu-server] close #2741: check for VM.Config.Cloudinit permission
Mira Limbeck
m.limbeck at proxmox.com
Wed Jun 24 12:12:27 CEST 2020
On 6/24/20 11:51 AM, Fabian Grünbichler wrote:
> On June 3, 2020 3:58 pm, Mira Limbeck wrote:
>> This allows setting ciuser, cipassword and all other cloudinit settings that
>> are not part of the network without VM.Config.Network permissions.
>>
>> Signed-off-by: Mira Limbeck <m.limbeck at proxmox.com>
>> ---
>> PVE/API2/Qemu.pm | 5 ++++-
>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
>> index 974ee3b..23a569e 100644
>> --- a/PVE/API2/Qemu.pm
>> +++ b/PVE/API2/Qemu.pm
>> @@ -357,8 +357,11 @@ my $check_vm_modify_config_perm = sub {
>> $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.PowerMgmt']);
>> } elsif ($diskoptions->{$opt}) {
>> $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
>> - } elsif ($cloudinitoptions->{$opt} || ($opt =~ m/^(?:net|ipconfig)\d+$/)) {
>> + } elsif ($opt =~ m/^(?:net|ipconfig)\d+$/) {
>> $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
>> + } elsif ($cloudinitoptions->{$opt}) {
>> + print "checking VM.Config.Cloudinit\n";
> print probably left from debugging?
Yes, somehow I missed that.
>
>> + $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Cloudinit']);
> shouldn't this also still work with VM.Config.Network to not break
> existing setups, at least for the duration of 6.x?
Yes, otherwise this breaks for custom roles.
>> } elsif ($opt eq 'vmstate') {
>> # the user needs Disk and PowerMgmt privileges to change the vmstate
>> # also needs privileges on the storage, that will be checked later
>> --
>> 2.20.1
>>
>>
>> _______________________________________________
>> pve-devel mailing list
>> pve-devel at pve.proxmox.com
>> https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>>
>>
> _______________________________________________
> pve-devel mailing list
> pve-devel at pve.proxmox.com
> https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
More information about the pve-devel
mailing list