[pve-devel] [PATCH container 3/4] fix #2582: api: use common helper for checking root privileges

[Oguz Bektas]

we just check if the authenticated user has the 'Sys.Root' privilege on
a given path and set the $is_root variable accordingly if so.

tagged as fix for #2582 since with this series the usecase on the
bugreport should be fulfilled.

Signed-off-by: Oguz Bektas <o.bektas at proxmox.com>
---
 src/PVE/API2/LXC.pm | 2 +-
 src/PVE/LXC.pm      | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index 7573814..64ecc5f 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -295,7 +295,7 @@ __PACKAGE__->register_method({
 
 	my $conf = {};
 
-	my $is_root = $authuser eq 'root at pam';
+	my $is_root = PVE::Tools::check_for_root("/vms");
 
 	my $no_disk_param = {};
 	my $mp_param = {};
diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index b07d986..1844b04 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1254,7 +1254,9 @@ sub template_create {
 sub check_ct_modify_config_perm {
     my ($rpcenv, $authuser, $vmid, $pool, $oldconf, $newconf, $delete, $unprivileged) = @_;
 
-    return 1 if $authuser eq 'root at pam';
+    my $is_root = PVE::Tools::check_for_root("/vms/$vmid");
+    return 1 if $is_root;
+
     my $storage_cfg = PVE::Storage::config();
 
     my $check = sub {
@@ -1320,12 +1322,13 @@ sub check_ct_modify_config_perm {
 		}
 	    }
 	    raise_perm_exc("changing feature flags (except nesting) is only allowed for root\@pam")
-		if $other_changed;
+		if $other_changed && !$is_root;
 	    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Allocate'])
 		if $nesting_changed;
 	} elsif ($opt eq 'hookscript') {
 	    # For now this is restricted to root at pam
-	    raise_perm_exc("changing the hookscript is only allowed for root\@pam");
+	    raise_perm_exc("changing the hookscript is only allowed for root\@pam")
+		if !$is_root;
 	} else {
 	    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 	}
-- 
2.30.2