[pve-devel] [PATCH v2 access-control++ 00/12] SuperUser privilege

[Oguz Bektas]

v1->v2:
* added some basic docs

changes in rest of the patches are in the separate mails.

big thanks to Fabian G. for the reviews and answering my questions
throughout the series :)

it's a complicated series so if i forgot something i'm sorry!

note: all the patches on the other repositories depend on the
access-control patches to be applied and installed first

 docs: Oguz Bektas (1):
  pveum: add SU privilege and SA role

 pveum.adoc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

 qemu-server: Oguz Bektas (2):
  api: allow SU privileged users to edit root-only options for VM
    configs
  api: allow 'skiplock' option to be used by SU privileged users

 PVE/API2/Qemu.pm | 122 ++++++++++++++++++++++++++++-------------------
 1 file changed, 72 insertions(+), 50 deletions(-)

 manager: Oguz Bektas (4):
  api: backup: allow SUs to use 'tmpdir', 'dumpdir' and 'script' options
  api: vzdump: allow SUs to use 'bwlimit' and 'ionice' parameters
  api: update comment about login prompt for non-root users
  ui: adapt sensible 'root at pam' checks to SU privilege

 PVE/API2/Backup.pm             | 11 ++++++++---
 PVE/API2/Nodes.pm              |  2 +-
 PVE/API2/VZDump.pm             |  8 +++++---
 www/manager6/dc/Config.js      |  2 +-
 www/manager6/lxc/Options.js    |  2 +-
 www/manager6/lxc/Resources.js  |  2 +-
 www/manager6/window/Migrate.js |  4 ++--
 7 files changed, 19 insertions(+), 12 deletions(-)

 container: Oguz Bektas (1):
  fix #2582: api: add checks for 'SuperUser' privilege for root-only
    options

 src/PVE/API2/LXC.pm        | 15 +++++++--------
 src/PVE/API2/LXC/Config.pm |  2 +-
 src/PVE/API2/LXC/Status.pm | 12 ++++++++----
 src/PVE/LXC.pm             | 21 ++++++++++++---------
 4 files changed, 28 insertions(+), 22 deletions(-)

 storage: Oguz Bektas (1):
  check_volume_access: allow superusers to pass arbitrary fs paths

 PVE/Storage.pm | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

 access-control: Oguz Bektas (3):
  add "SuperAdministrator" role with the new "SuperUser" privilege
  api: allow superusers to edit tfa and password settings
  api: acl: only allow granting SU privilege if user already has it

 src/PVE/API2/ACL.pm           | 9 +++++++++
 src/PVE/API2/AccessControl.pm | 6 ++++++
 src/PVE/API2/TFA.pm           | 7 +++++--
 src/PVE/AccessControl.pm      | 9 ++++++---
 src/PVE/RPCEnvironment.pm     | 2 +-
 5 files changed, 27 insertions(+), 6 deletions(-)

-- 
2.30.2