[pve-devel] [PATCH cluster v8 4/4] DataCenterConfig: add tag rights control to the datacenter config

[Dominik Csapak]

by adding a 'user-tag-privileges' and 'admin-tags' option.
The first sets the policy by which "normal" users (with
'VM.Config.Options' on the respective guest) can create/delete tags
and the second is a list of tags only settable by 'admins'
('Sys.Modify' on '/')

also add a helper 'get_user_admin_tags' that returns two hashmaps that
determines the allowed user tags and admin tags that require elevated
permissions

Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
---
 data/PVE/DataCenterConfig.pm | 93 ++++++++++++++++++++++++++++++++++++
 1 file changed, 93 insertions(+)

diff --git a/data/PVE/DataCenterConfig.pm b/data/PVE/DataCenterConfig.pm
index bb29d26..e2140ff 100644
--- a/data/PVE/DataCenterConfig.pm
+++ b/data/PVE/DataCenterConfig.pm
@@ -154,6 +154,26 @@ my $tag_style_format = {
     },
 };
 
+my $user_tag_privs_format = {
+    'usable' => {
+	optional => 1,
+	type => 'string',
+	enum => ['none', 'list', 'existing', 'free'],
+	default => 'free',
+	dscription => "Determines which tags a user without Sys.Modify on '/' can set and delete. ".
+	    "'none' means no tags are settable.'list' allows tags from the given list. ".
+	    "'existing' means only already existing tags or from the given list. ".
+	    "And 'free' means users can assign any tags."
+    },
+    'list' => {
+	optional => 1,
+	type => 'string',
+	pattern => "${PVE::JSONSchema::PVE_TAG_RE}(?:\;${PVE::JSONSchema::PVE_TAG_RE})*",
+	typetext => "<tag>[;<tag>=...]",
+	description => "List of tags users are allowd to set and delete (semicolon separated).",
+    },
+};
+
 my $datacenter_schema = {
     type => "object",
     additionalProperties => 0,
@@ -285,12 +305,60 @@ my $datacenter_schema = {
 	    description => "Tag style options.",
 	    format => $tag_style_format,
 	},
+	'user-tag-privileges' => {
+	    optional => 1,
+	    type => 'string',
+	    description => "Privilege options for user settable tags",
+	    format => $user_tag_privs_format,
+	},
+	'admin-tags' => {
+	    optional => 1,
+	    type => 'string',
+	    description => "A list of tags only admins (Sys.Modify on '/') are allowed to set/delete",
+	    pattern => "(?:${PVE::JSONSchema::PVE_TAG_RE};)*${PVE::JSONSchema::PVE_TAG_RE}",
+	},
     },
 };
 
 # make schema accessible from outside (for documentation)
 sub get_datacenter_schema { return $datacenter_schema };
 
+# returns two hashmaps of tags, the first is the list of tags that can
+# be used by users with 'VM.Config.Options', and the second is a list
+# that needs 'Sys.Modify' on '/'
+#
+# If the first map is 'undef', it means there is generally no restriction
+# besides the tags defined in the second map.
+#
+# CAUTION: this function may include tags from *all* guest configs,
+# regardless of the current authuser
+sub get_user_admin_tags {
+    my $user_tags = {};
+    my $admin_tags = {};
+
+    my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
+    if (my $user_tag_privs = $dc->{'user-tag-privileges'}) {
+	my $usable = $user_tag_privs->{usable} // 'free';
+	if ($usable eq 'free') {
+	    $user_tags = undef;
+	} elsif ($usable eq 'existing') {
+	    map { $user_tags->{$_} = 1 } ($user_tag_privs->{list} // [])->@*;
+	    my $props = PVE::Cluster::get_guest_config_properties(['tags']);
+	    for my $vmid (keys $props->%*) {
+		map { $user_tags->{$_} = 1 } PVE::Tools::split_list($props->{$vmid}->{tags});
+	    }
+	} elsif ($usable eq 'list') {
+	    map { $user_tags->{$_} = 1 } ($user_tag_privs->{list} // [])->@*;
+	}
+    }
+    if (my $tags = $dc->{'admin-tags'}) {
+	$admin_tags = {};
+	map { $admin_tags->{$_} = 1 } $tags->@*;
+    }
+
+    return ($user_tags, $admin_tags);
+}
+
 sub parse_datacenter_config {
     my ($filename, $raw) = @_;
 
@@ -333,6 +401,19 @@ sub parse_datacenter_config {
 	$res->{'tag-style'} = parse_property_string($tag_style_format, $tag_style);
     }
 
+    if (my $user_tag_privs = $res->{'user-tag-privileges'}) {
+	$res->{'user-tag-privileges'} =
+	    parse_property_string($user_tag_privs_format, $user_tag_privs);
+
+	    if (my $user_tags = $res->{'user-tag-privileges'}->{list}) {
+	        $res->{'user-tag-privileges'}->{list} = [split(';', $user_tags)];
+	    }
+    }
+
+    if (my $admin_tags = $res->{'admin-tags'}) {
+	$res->{'admin-tags'} = [split(';', $admin_tags)];
+    }
+
     # for backwards compatibility only, new migration property has precedence
     if (defined($res->{migration_unsecure})) {
 	if (defined($res->{migration}->{type})) {
@@ -396,6 +477,18 @@ sub write_datacenter_config {
 	$cfg->{'tag-style'} = PVE::JSONSchema::print_property_string($tag_style, $tag_style_format);
     }
 
+    if (ref(my $user_tag_privs = $cfg->{'user-tag-privileges'})) {
+	if (my $user_tags = $user_tag_privs->{list}) {
+	    $user_tag_privs->{list} = join(';', sort ($user_tags));
+	}
+	$cfg->{'user-tag-privileges'} =
+	    PVE::JSONSchema::print_property_string($user_tag_privs, $user_tag_privs_format);
+    }
+
+    if (ref(my $admin_tags = $cfg->{'admin-tags'})) {
+	$cfg->{'admin-tags'} = join(';', sort $admin_tags->@*);
+    }
+
     my $comment = '';
     # add description as comment to top of file
     my $description = $cfg->{description} || '';
-- 
2.30.2