[pve-devel] [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge
Alexandre Derumier
aderumier at odiso.com
Wed Jun 7 14:03:47 CEST 2023
add vnet/localbridge permissions management
Hi,
as we has discuted some weeks ago,
this patche serie introduce management of acl for vnets && local bridges
The permission path is:
/sdn/zones/<zone>/<vnet>
where the local vmbr are in a virtual "localnetwork" zone
/sdn/zones/localnetwork/<vnet>
Vlans permissions are also handled with
/sdn/zones/<zone>/<vnet>/<tag>
if user have permissions on the vnet/tag, he have access to only the specific vlan.
if user have permissions on the vnet with propagate, he have access to all vlans of the vnet
if user have permissions on the vnet without propagate, he have access to bridge only without any vlan
I have reworked the sdn zone panel from the tree, to manage permissions
on displayed vnets. (patch 3 && 4 pve-manager)
some screenshots:
https://mutulin1.odiso.net/sdnzone-perm.png
https://mutulin1.odiso.net/localzone-perm.png
changelog v2:
- use /vnets/vlan instead /vnets.vlan
- rework the bridge filtering when user have access only to a specific vlan
- api2 network: always check bridge access if no filter is defined
changelog v3:
- use /sdn/zones/<zone>/vnets/vlan instead /sdn/vnets/vnets.vlan
- add SDN.Use permission
- pve-manager: split ui code (could be applied later)
- remove check on zone (it's now propagate with new path)
- move check_vnet_access to pve-guest-common for lxc reuse
- pve-network: fix vnet/tag perm check
changelog v4:
- qemu-server: check permissions on backup restore
- guest-common: check trunks permissions
todo:
- implement lxc check permissions
pve-access-control:
Alexandre Derumier (3):
access control: add /sdn/zones/<zone>/<vnet>/<vlan> path
rpcenvironnment: add check_sdn_bridge
add new SDN.use privilege in PVESDNUser role
src/PVE/AccessControl.pm | 6 +++++-
src/PVE/RPCEnvironment.pm | 18 ++++++++++++++++++
2 files changed, 23 insertions(+), 1 deletion(-)
pve-manager:
Alexandre Derumier (4):
api2: network: check permissions for local bridges
api2: cluster: ressources: add "localnetwork" zone
ui: add vnet permissions panel
ui: add permissions management for "localnetwork" zone
PVE/API2/Cluster.pm | 14 ++
PVE/API2/Network.pm | 25 ++-
www/manager6/Makefile | 2 +
www/manager6/sdn/Browser.js | 17 +-
www/manager6/sdn/VnetACLView.js | 289 +++++++++++++++++++++++++++
www/manager6/sdn/ZoneContentPanel.js | 41 ++++
www/manager6/sdn/ZoneContentView.js | 52 ++++-
7 files changed, 411 insertions(+), 29 deletions(-)
create mode 100644 www/manager6/sdn/VnetACLView.js
create mode 100644 www/manager6/sdn/ZoneContentPanel.js
pve-guest-common:
Alexandre Derumier (1):
helpers : add check_vnet_access
src/PVE/GuestHelpers.pm | 49 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 49 insertions(+)
qemu-server:
Alexandre Derumier (1):
api2: add check_bridge_access for create/update/clone/restore vm
PVE/API2/Qemu.pm | 33 +++++++++++++++++++++++++++++----
1 file changed, 29 insertions(+), 4 deletions(-)
pve-network:
Alexandre Derumier (1):
get_local_vnets: fix permission path && perm
PVE/Network/SDN.pm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--
2.30.2
More information about the pve-devel
mailing list