[pve-devel] [PATCH v4 docs 18/18] pveum: add SU privilege and SA role

[Oguz Bektas]

with some warnings about imposed restrictions and the danger of giving
this role/privilege to untrusted users.

Suggested-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
Signed-off-by: Oguz Bektas <o.bektas at proxmox.com>
---
 pveum.adoc | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pveum.adoc b/pveum.adoc
index 840067e..8067984 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -705,7 +705,11 @@ Roles
 A role is simply a list of privileges. Proxmox VE comes with a number
 of predefined roles, which satisfy most requirements.
 
-* `Administrator`: has full privileges
+* `SuperAdministrator`: has **full** privileges including `SuperUser`
+* `Administrator`: has all privileges **except** `SuperUser`
+
+NOTE: `SuperAdministrator` role is equivalent to 'root at pam'! Do not give this role to untrusted users.
+
 * `NoAccess`: has no privileges (used to forbid access)
 * `PVEAdmin`: can do most tasks, but has no rights to modify system settings (`Sys.PowerMgmt`, `Sys.Modify`, `Realm.Allocate`)
 * `PVEAuditor`: has read only access
@@ -748,6 +752,14 @@ We currently support the following privileges:
 
 Node / System related privileges::
 
+* `SuperUser`: modify root-only configuration options (warning! **do
+not give this privilege to untrusted users**)
+
+NOTE: `SuperUser` privilege by itself does not equal the access level of 'root at pam'.
+
+NOTE: Certain actions on users with the `SuperUser` privilege are restricted to others
+with `SuperUser`, i.e. changing their password or two-factor-authentication settings
+
 * `Permissions.Modify`: modify access permissions
 * `Sys.PowerMgmt`: node power management (start, stop, reset, shutdown, ...)
 * `Sys.Console`: console access to node
-- 
2.30.2