[pve-devel] [PATCH v4 storage 17/18] check_volume_access: allow superusers to pass arbitrary fs paths

[Oguz Bektas]

Signed-off-by: Oguz Bektas <o.bektas at proxmox.com>
---
 PVE/Storage.pm | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/PVE/Storage.pm b/PVE/Storage.pm
index 72458cf..f6da63d 100755
--- a/PVE/Storage.pm
+++ b/PVE/Storage.pm
@@ -510,6 +510,11 @@ sub parse_volume_id {
 sub check_volume_access {
     my ($rpcenv, $user, $cfg, $vmid, $volid, $type) = @_;
 
+    return if $user eq 'root at pam'; # root at pam always OK
+
+    # SU on '/' needed for passing arbitrary filesystem paths
+    my $is_superuser = $rpcenv->check($user, "/", ['SuperUser'], 1);
+
     my ($sid, $volname) = parse_volume_id($volid, 1);
     if ($sid) {
 	my ($vtype, undef, $ownervm) = parse_volname($cfg, $volid);
@@ -535,8 +540,8 @@ sub check_volume_access {
 	    die "missing privileges to access $volid\n";
 	}
     } else {
-	die "Only root can pass arbitrary filesystem paths."
-	    if $user ne 'root at pam';
+	die "Only superusers can pass arbitrary filesystem paths."
+	    if !$is_superuser;
     }
 
     return undef;
-- 
2.30.2