[pve-devel] [PATCH v2 access-control++ 00/12] SuperUser privilege

[Fabian Grünbichler]

On March 11, 2022 12:24 pm, Oguz Bektas wrote:
> v1->v2:
> * added some basic docs

still missing even though I requested this a few times already:
- list of API paths that are root-only still and why/plans on how to 
  proceed there
- list of other things which are root-only still and why/plans on how to 
  proceed there

or alternatively, comments where it makes sense for stuff that is and 
remains root-only intentionally (forever, or for the time being).

it's really hard otherwise for me to know what was missed/not looked 
at/skipped for $reasons which are valid/skipped for $reasons which are 
wrong.

> 
> changes in rest of the patches are in the separate mails.
> 
> big thanks to Fabian G. for the reviews and answering my questions
> throughout the series :)
> 
> it's a complicated series so if i forgot something i'm sorry!
> 
> note: all the patches on the other repositories depend on the
> access-control patches to be applied and installed first
> 
>  docs: Oguz Bektas (1):
>   pveum: add SU privilege and SA role
> 
>  pveum.adoc | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
>  qemu-server: Oguz Bektas (2):
>   api: allow SU privileged users to edit root-only options for VM
>     configs
>   api: allow 'skiplock' option to be used by SU privileged users

missing in qemu-server (besides stuff noted in reply to the patches):
- an unmarked shortcut in $parse_backup_hints

> 
>  PVE/API2/Qemu.pm | 122 ++++++++++++++++++++++++++++-------------------
>  1 file changed, 72 insertions(+), 50 deletions(-)
> 
>  manager: Oguz Bektas (4):
>   api: backup: allow SUs to use 'tmpdir', 'dumpdir' and 'script' options
>   api: vzdump: allow SUs to use 'bwlimit' and 'ionice' parameters
>   api: update comment about login prompt for non-root users
>   ui: adapt sensible 'root at pam' checks to SU privilege
> 
>  PVE/API2/Backup.pm             | 11 ++++++++---
>  PVE/API2/Nodes.pm              |  2 +-
>  PVE/API2/VZDump.pm             |  8 +++++---
>  www/manager6/dc/Config.js      |  2 +-
>  www/manager6/lxc/Options.js    |  2 +-
>  www/manager6/lxc/Resources.js  |  2 +-
>  www/manager6/window/Migrate.js |  4 ++--
>  7 files changed, 19 insertions(+), 12 deletions(-)
> 
>  container: Oguz Bektas (1):
>   fix #2582: api: add checks for 'SuperUser' privilege for root-only
>     options
> 
>  src/PVE/API2/LXC.pm        | 15 +++++++--------
>  src/PVE/API2/LXC/Config.pm |  2 +-
>  src/PVE/API2/LXC/Status.pm | 12 ++++++++----
>  src/PVE/LXC.pm             | 21 ++++++++++++---------
>  4 files changed, 28 insertions(+), 22 deletions(-)
> 
>  storage: Oguz Bektas (1):
>   check_volume_access: allow superusers to pass arbitrary fs paths
> 
>  PVE/Storage.pm | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
>  access-control: Oguz Bektas (3):
>   add "SuperAdministrator" role with the new "SuperUser" privilege
>   api: allow superusers to edit tfa and password settings
>   api: acl: only allow granting SU privilege if user already has it
> 
>  src/PVE/API2/ACL.pm           | 9 +++++++++
>  src/PVE/API2/AccessControl.pm | 6 ++++++
>  src/PVE/API2/TFA.pm           | 7 +++++--
>  src/PVE/AccessControl.pm      | 9 ++++++---
>  src/PVE/RPCEnvironment.pm     | 2 +-
>  5 files changed, 27 insertions(+), 6 deletions(-)
> 
> -- 
> 2.30.2
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
> 
>