[pve-devel] [PATCH v1 access-control++ 0/5] SuperUser privilege

[Oguz Bektas]

"SuperUser" (henceforth referred as SU) privilege allows to give
root-only permissions to API users, enabling them to perform privileged
actions on behalf of root at pam.

this privilege is enabled by default for "root at pam", and also mapped
inside "SuperAdministrator" (referred as SA)

changes from RFC (thanks for the review fabian g.!):
* manager: allow SAs to see/edit certain things on GUI
* qemu-server: also check the required non-root
VM privileges along with the SU priv
* pve-container: adapted error messages, changed variable name to
"is_superuser" for better clarity (in comparison to prev. "is_root"
which is a bit confusing)
* access-control: TFA permissions adaptation for SAs


 access-control:

 Oguz Bektas (2):
  add "SuperAdministrator" role with the new "SuperUser" privilege
  tfa: allow superusers to edit root at pam tfa

 src/PVE/API2/TFA.pm       | 7 +++++--
 src/PVE/AccessControl.pm  | 9 ++++++---
 src/PVE/RPCEnvironment.pm | 2 +-
 3 files changed, 12 insertions(+), 6 deletions(-)

 container:

 Oguz Bektas (1):
  fix #2582: api: add checks for 'SuperUser' privilege for root-only
    options

 src/PVE/API2/LXC.pm        | 13 ++++++-------
 src/PVE/API2/LXC/Status.pm |  8 ++++++--
 src/PVE/LXC.pm             |  9 ++++++---
 3 files changed, 18 insertions(+), 12 deletions(-)

 manager:

 Oguz Bektas (1):
  change 'root at pam' checks with 'SuperUser' capability check

 www/manager6/Utils.js          | 3 ++-
 www/manager6/dc/Config.js      | 2 +-
 www/manager6/dc/UserView.js    | 2 +-
 www/manager6/lxc/Options.js    | 2 +-
 www/manager6/lxc/Resources.js  | 2 +-
 www/manager6/node/Config.js    | 2 +-
 www/manager6/window/Migrate.js | 4 ++--
 7 files changed, 9 insertions(+), 8 deletions(-)

 qemu-server:

 Oguz Bektas (1):
  add SuperUser privilege checks for root-only options

 PVE/API2/Qemu.pm | 119 +++++++++++++++++++++++++++++------------------
 1 file changed, 73 insertions(+), 46 deletions(-)

-- 
2.30.2