[pve-devel] applied-series: [PATCH-SERIES v2 manager/storage/container/qemu-server] improve check_volume_access

[Fabian Grünbichler]

with potential for the following follow-up:
- uploading isos/templates or downloading them currently requires 
  Datastore.AllocateTemplate
- deleting isos/templates currently requires Datastore.Allocate

the latter could get a less restrictive check like we already have for 
backup volumes, to allow users with just 'manage templates/isos' 
permissions to remove the stuff they can create ;)

On March 30, 2022 12:24 pm, Fabian Ebner wrote:
> The first few patches are to allow access for users with
> Datastore.Allocate privilege, without automatically giving them
> permission to extract a backup config.
> 
> Patch storage 3/6 is in preparation for the import-from API, allowing
> users with VM.Config.Disk (and Datastore.Audit) to list images of
> their VMs.
> 
> The rest of the series introduces a content type parameter to
> check_volume_access() for future-proofing.
> 
> Patch storage 2/6 technically breaks older manager, allowing all users
> with Datastore.Allocate to extract backup configs, but I'm not sure
> that's worth bothering about.
> 
> Dependency bumps for storage are needed for the content parameter to
> actually have an effect.
> 
> 
> Changes from v1:
>     * Always allow with Datastore.Allocate privilege.
>     * Also check for Datastore.Audit when listing guest images/rootdir
>       rather than just VM.Config.Disk.
> 
> 
> manager:
> 
> Fabian Ebner (3):
>   api: vzdump: extract config: check for VM.Backup privilege
>   pveam: remove: add content type check
>   api: vzdump: extract config: add content type check
> 
>  PVE/API2/VZDump.pm | 14 +++++++++++++-
>  PVE/CLI/pveam.pm   |  2 +-
>  2 files changed, 14 insertions(+), 2 deletions(-)
> 
> 
> storage:
> 
> Fabian Ebner (6):
>   pvesm: extract config: check for VM.Backup privilege
>   check volume access: always allow with Datastore.Allocate privilege
>   check volume access: allow for images/rootdir if user has
>     VM.Config.Disk
>   check volume accesss: add content type parameter
>   pvesm: extract config: add content type check
>   api: file restore: use check_volume_access to restrict content type
> 
>  PVE/API2/Storage/FileRestore.pm | 12 ++++--------
>  PVE/CLI/pvesm.pm                | 14 +++++++++++++-
>  PVE/Storage.pm                  | 15 ++++++++++++---
>  3 files changed, 29 insertions(+), 12 deletions(-)
> 
> 
> container:
> 
> Fabian Ebner (1):
>   api: create/modify: add content type checks
> 
>  src/PVE/API2/LXC.pm | 10 +++++++++-
>  src/PVE/LXC.pm      |  9 ++++++++-
>  2 files changed, 17 insertions(+), 2 deletions(-)
> 
> 
> qemu-server:
> 
> Fabian Ebner (1):
>   api: create/modify: add content type checks
> 
>  PVE/API2/Qemu.pm | 27 ++++++++++++++++++++++++---
>  1 file changed, 24 insertions(+), 3 deletions(-)
> 
> -- 
> 2.30.2
> 
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
> 
>