[pve-devel] applied-series: fix #5254: add separate Sys.AccessNetwork privilege

[Thomas Lamprecht]

Am 19/02/2024 um 18:14 schrieb Thomas Lamprecht:
> Adds a new Sys.AccessNetwork privilege that can be used to guard API
> endpoints that can do outgoing network requests with (some) user control
> over said requests, like e.g. the "download URL to storage" one.
> 
> ## Backstory:
> 
> This stems from an user request [0] w.r.t. the "download image through
> and URL directly to a storage" functionality and their use case of that
> through automation while wanting to adhere to the principle of least
> privilege.
> 
> Because before this series the access to the required endpoints was
> guarded by the more powerful Sys.Modify and Sys.Audit privilege
> requirement on the / root ACL object path.
> So, if anybody wants to set up an API token so that automation can
> handle image downloads they'd need to give that API token very powerful
> permissions to make it work.
> 
> A more specialized privilege seems warranted now, so add the
> Sys.AccessNetwork one and adapt the /nodes/{node}/query-url-metadata and
> the related /nodes/{node}/storage/{storage}/download-url API endpoints
> for now.
> 
> ## Testing:
> 
> Tested by creating a new custom role with the privileges
> `Datastore.Audit,Datastore.AllocateTemplate,Sys.AccessNetwork`, then
> created a user that gets a permission with above role for a specific
> node and a storage and then try querying and downloading an image, with
> and without this patch series applied.
> 
> ## Future Work
> 
> We could this even re-use for other endpoints, like adding storages that
> are accessed through the network, as that provides a (limited) side
> channel too.
> 
> access-control:
> 
> Thomas Lamprecht (1):
>       add Sys.AccessNetwork privilege
> 
>  src/PVE/AccessControl.pm | 1 +
>  src/test/perm-test1.pl   | 2 +-
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> storage:
> 
> Thomas Lamprecht (1):
>       fix #5254: api: allow usage of download-url with Sys.AccessNetwork
> 
>  src/PVE/API2/Storage/Status.pm | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> manager:
> 
> Thomas Lamprecht (2):
>       api: nodes: allow usage of query url metadata with Sys.AccessNetwork
>       ui: storage: enable download-url button with Sys.AccessNetwork capability
> 
>  PVE/API2/Nodes.pm               | 5 ++++-
>  www/manager6/storage/Browser.js | 5 ++++-
>  2 files changed, 8 insertions(+), 2 deletions(-)
> 

applied series with Hannes' T-b and Fabians' R-b, thanks for the test/review!