[pve-devel] [PATCH access-control 1/9] add VM.GuestAgent privileges

[Fiona Ebner]

The privilege VM.Monitor has a very ambiguous name and is planned to
be dropped. Most of the API endpoints using it are for the QEMU guest
agent commands. Introduce dedicated, more fine-grained privileges for
those.

There is a basic VM.GuestAgent.Audit privilege for read-only,
informational commands.

There are dedicated privileges VM.GuestAgent.File{Read,Write} for
the file-{read,write} commands. There is a separate
VM.GuestAgent.FileSystemMgmt privilege for filesystem freeze, thaw
and trim.

The VM.GuestAgent.Unrestricted privilege is to allow all guest agent
operations, in particular also execution of arbitrary commands with
guest-exec.

Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---
 src/PVE/AccessControl.pm | 6 +++++-
 src/test/perm-test1.pl   | 8 ++++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index cebb76f..3e12850 100644
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -1059,6 +1059,7 @@ my $privgroups = {
             'VM.Config.Options', # covers all other things
             'VM.Allocate',
             'VM.Clone',
+            'VM.GuestAgent.Unrestricted',
             'VM.Migrate',
             'VM.Monitor',
             'VM.Snapshot',
@@ -1069,10 +1070,13 @@ my $privgroups = {
             'VM.Config.Cloudinit',
             'VM.Console',
             'VM.Backup',
+            'VM.GuestAgent.FileRead',
+            'VM.GuestAgent.FileSystemMgmt',
+            'VM.GuestAgent.FileWrite',
             'VM.PowerMgmt',
         ],
         audit => [
-            'VM.Audit',
+            'VM.Audit', 'VM.GuestAgent.Audit',
         ],
     },
     Sys => {
diff --git a/src/test/perm-test1.pl b/src/test/perm-test1.pl
index 69b396e..bf01ac6 100755
--- a/src/test/perm-test1.pl
+++ b/src/test/perm-test1.pl
@@ -65,7 +65,9 @@ check_permission(
     '' # sorted, comma-separated expected privilege string
         . 'VM.Allocate,VM.Audit,VM.Backup,VM.Clone,VM.Config.CDROM,VM.Config.CPU,VM.Config.Cloudinit,'
         . 'VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,'
-        . 'VM.Console,VM.Migrate,VM.Monitor,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback',
+        . 'VM.Console,VM.GuestAgent.Audit,VM.GuestAgent.FileRead,VM.GuestAgent.FileSystemMgmt,'
+        . 'VM.GuestAgent.FileWrite,VM.GuestAgent.Unrestricted,VM.Migrate,VM.Monitor,VM.PowerMgmt,'
+        . 'VM.Snapshot,VM.Snapshot.Rollback',
 );
 # Administrator -> Permissions.Modify!
 check_permission(
@@ -83,7 +85,9 @@ check_permission(
         . 'User.Modify,'
         . 'VM.Allocate,VM.Audit,VM.Backup,VM.Clone,VM.Config.CDROM,VM.Config.CPU,VM.Config.Cloudinit,'
         . 'VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,'
-        . 'VM.Console,VM.Migrate,VM.Monitor,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback',
+        . 'VM.Console,VM.GuestAgent.Audit,VM.GuestAgent.FileRead,VM.GuestAgent.FileSystemMgmt,'
+        . 'VM.GuestAgent.FileWrite,VM.GuestAgent.Unrestricted,VM.Migrate,VM.Monitor,VM.PowerMgmt,'
+        . 'VM.Snapshot,VM.Snapshot.Rollback',
 );
 
 check_roles('max at pve', '/vms/200', 'storage_manager');
-- 
2.47.2