From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id E84C11FF0E5 for ; Wed, 15 Jul 2026 17:00:16 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4897C21441; Wed, 15 Jul 2026 17:00:16 +0200 (CEST) Message-ID: <09b9d739-9bc1-4eea-b5fc-c5bbb6118686@proxmox.com> Date: Wed, 15 Jul 2026 16:59:42 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH pve-access-control v5 1/7] permission: add acl tree node parent lookup without node creation To: pve-devel@lists.proxmox.com References: <20260707120404.73072-1-d.riley@proxmox.com> <20260707120404.73072-2-d.riley@proxmox.com> Content-Language: en-US From: Stefan Hanreich In-Reply-To: <20260707120404.73072-2-d.riley@proxmox.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.188 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: TBBSQMDE7PPVZM4JTAF4WHOM3YAQXBPX X-Message-ID-Hash: TBBSQMDE7PPVZM4JTAF4WHOM3YAQXBPX X-MailFrom: s.hanreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 7/7/26 2:05 PM, David Riley wrote: > Add helper function to look up ACL nodes by path without creating > missing nodes along the path. This is necessary for safely locating > paths intended for deletion or migration without side effects. > > This is in preparation for the following SDN resource ACL pruning and > VNet migration changes. > > Signed-off-by: David Riley > --- > src/PVE/AccessControl.pm | 25 +++++++++++++++++++++++++ > 1 file changed, 25 insertions(+) > > diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm > index 0d632b3..e26dfce 100644 > --- a/src/PVE/AccessControl.pm > +++ b/src/PVE/AccessControl.pm > @@ -1000,6 +1000,31 @@ sub find_acl_tree_node { > return $node; > } > > +# finds an ACL node by path without autovivifying (creating) missing > +# nodes. returns a list containing the parent node, the final path > +# segment, and the target node itself. Max worked on an RFC [1] on how to document Perl code, which employs POD, might be worthwhile to read up on it and write newer documentation in that style. [1] https://wiki.intra.proxmox.com/Perl_Documentation > +sub find_acl_tree_node_parent { > + my ($root, $path) = @_; > + > + my $current = $root; > + my $parent = undef; > + my $last_key = undef; > + > + my @split_path = split('/', $path); > + > + for my $segment (@split_path) { > + if (defined($current->{children}) && defined($current->{children}->{$segment})) { > + $parent = $current; > + $last_key = $segment; > + $current = $current->{children}->{$segment}; > + } else { > + return (undef, undef, undef); > + } > + } > + > + return ($parent, $last_key, $current); > +} > + > sub add_user_group { > my ($username, $usercfg, $group) = @_; >