[pve-devel] fix #5254: add separate Sys.AccessNetwork privilege

[Hannes Dürr]

Tested the patch by

1.

* creating a role with 
'Datastore.Audit,Datastore.AllocateTemplate,Sys.AccessNetwork'

* creating a user with permission for specific {storage} and {node}

* downloading the iso via gui

2.

* creating a role with 'Datastore.AllocateTemplate,Sys.AccessNetwork'

* creating an API Token with permission for specific {storage} and {node}

* querying image via the endpoint nodes/{node}/query-url-metadata

* downloading the image via the endpoint 
nodes/{node}/storage/{storage}/download-url

Tested-by: Hannes Duerr <h.duerr at proxmox.com>


On 2/19/24 18:14, Thomas Lamprecht wrote:
> Adds a new Sys.AccessNetwork privilege that can be used to guard API
> endpoints that can do outgoing network requests with (some) user control
> over said requests, like e.g. the "download URL to storage" one.
>
> ## Backstory:
>
> This stems from an user request [0] w.r.t. the "download image through
> and URL directly to a storage" functionality and their use case of that
> through automation while wanting to adhere to the principle of least
> privilege.
>
> Because before this series the access to the required endpoints was
> guarded by the more powerful Sys.Modify and Sys.Audit privilege
> requirement on the / root ACL object path.
> So, if anybody wants to set up an API token so that automation can
> handle image downloads they'd need to give that API token very powerful
> permissions to make it work.
>
> A more specialized privilege seems warranted now, so add the
> Sys.AccessNetwork one and adapt the /nodes/{node}/query-url-metadata and
> the related /nodes/{node}/storage/{storage}/download-url API endpoints
> for now.
>
> ## Testing:
>
> Tested by creating a new custom role with the privileges
> `Datastore.Audit,Datastore.AllocateTemplate,Sys.AccessNetwork`, then
> created a user that gets a permission with above role for a specific
> node and a storage and then try querying and downloading an image, with
> and without this patch series applied.
>
> ## Future Work
>
> We could this even re-use for other endpoints, like adding storages that
> are accessed through the network, as that provides a (limited) side
> channel too.
>
> access-control:
>
> Thomas Lamprecht (1):
>        add Sys.AccessNetwork privilege
>
>   src/PVE/AccessControl.pm | 1 +
>   src/test/perm-test1.pl   | 2 +-
>   2 files changed, 2 insertions(+), 1 deletion(-)
>
> storage:
>
> Thomas Lamprecht (1):
>        fix #5254: api: allow usage of download-url with Sys.AccessNetwork
>
>   src/PVE/API2/Storage/Status.pm | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
>
> manager:
>
> Thomas Lamprecht (2):
>        api: nodes: allow usage of query url metadata with Sys.AccessNetwork
>        ui: storage: enable download-url button with Sys.AccessNetwork capability
>
>   PVE/API2/Nodes.pm               | 5 ++++-
>   www/manager6/storage/Browser.js | 5 ++++-
>   2 files changed, 8 insertions(+), 2 deletions(-)
>
>
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>