From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <f.gruenbichler@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id DA19D609BA
for <pbs-devel@lists.proxmox.com>; Mon, 19 Oct 2020 09:40:38 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id D736D29A90
for <pbs-devel@lists.proxmox.com>; Mon, 19 Oct 2020 09:40:08 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
[212.186.127.180])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS id 425E9299AB
for <pbs-devel@lists.proxmox.com>; Mon, 19 Oct 2020 09:40:08 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 0B6F545DFE
for <pbs-devel@lists.proxmox.com>; Mon, 19 Oct 2020 09:40:08 +0200 (CEST)
From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
To: pbs-devel@lists.proxmox.com
Date: Mon, 19 Oct 2020 09:39:17 +0200
Message-Id: <20201019073919.588521-14-f.gruenbichler@proxmox.com>
X-Mailer: git-send-email 2.20.1
In-Reply-To: <20201019073919.588521-1-f.gruenbichler@proxmox.com>
References: <20201019073919.588521-1-f.gruenbichler@proxmox.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results: 0
AWL 0.031 Adjusted score from AWL reputation of From: address
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/,
medium trust
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
Subject: [pbs-devel] [RFC proxmox-backup 13/15] tasks: allow unpriv users to
read their tokens' tasks
X-BeenThere: pbs-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox Backup Server development discussion
<pbs-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pbs-devel>,
<mailto:pbs-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pbs-devel/>
List-Post: <mailto:pbs-devel@lists.proxmox.com>
List-Help: <mailto:pbs-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel>,
<mailto:pbs-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Mon, 19 Oct 2020 07:40:38 -0000
and tighten down the return schema while we're at it.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
src/api2/node/tasks.rs | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
diff --git a/src/api2/node/tasks.rs b/src/api2/node/tasks.rs
index b86eaec7..379ec6fc 100644
--- a/src/api2/node/tasks.rs
+++ b/src/api2/node/tasks.rs
@@ -14,6 +14,14 @@ use crate::server::{self, UPID, TaskState, TaskListInfoIterator};
use crate::config::acl::{PRIV_SYS_AUDIT, PRIV_SYS_MODIFY};
use crate::config::cached_user_info::CachedUserInfo;
+fn check_task_access(auth_user: &Userid, task_user: &Userid) -> Result<(), Error> {
+ if auth_user == task_user || (task_user.is_tokenid() && &task_user.owner().unwrap() == auth_user) {
+ Ok(())
+ } else {
+ let user_info = CachedUserInfo::new()?;
+ user_info.check_privs(auth_user, &["system", "tasks"], PRIV_SYS_AUDIT, false)
+ }
+}
#[api(
input: {
@@ -57,7 +65,7 @@ use crate::config::cached_user_info::CachedUserInfo;
description: "Worker ID (arbitrary ASCII string)",
},
user: {
- type: String,
+ schema: PROXMOX_USER_OR_TOKEN_ID_SCHEMA,
description: "The user who started the task.",
},
status: {
@@ -85,11 +93,7 @@ async fn get_task_status(
let upid = extract_upid(¶m)?;
let userid: Userid = rpcenv.get_user().unwrap().parse()?;
-
- if userid != upid.userid {
- let user_info = CachedUserInfo::new()?;
- user_info.check_privs(&userid, &["system", "tasks"], PRIV_SYS_AUDIT, false)?;
- }
+ check_task_access(&userid, &upid.userid)?;
let mut result = json!({
"upid": param["upid"],
@@ -162,11 +166,7 @@ async fn read_task_log(
let upid = extract_upid(¶m)?;
let userid: Userid = rpcenv.get_user().unwrap().parse()?;
-
- if userid != upid.userid {
- let user_info = CachedUserInfo::new()?;
- user_info.check_privs(&userid, &["system", "tasks"], PRIV_SYS_AUDIT, false)?;
- }
+ check_task_access(&userid, &upid.userid)?;
let test_status = param["test-status"].as_bool().unwrap_or(false);
@@ -326,7 +326,9 @@ pub fn list_tasks(
Err(_) => return None,
};
- if !list_all && info.upid.userid != userid { return None; }
+ if !list_all && check_task_access(&userid, &info.upid.userid).is_err() {
+ return None;
+ }
if let Some(userid) = &userfilter {
if !info.upid.userid.as_str().contains(userid) { return None; }
--
2.20.1