From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <d.csapak@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id 11B15696E0
for <pbs-devel@lists.proxmox.com>; Tue, 2 Mar 2021 16:31:22 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 081AE2ED38
for <pbs-devel@lists.proxmox.com>; Tue, 2 Mar 2021 16:31:22 +0100 (CET)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
[212.186.127.180])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS id E28542ED2D
for <pbs-devel@lists.proxmox.com>; Tue, 2 Mar 2021 16:31:20 +0100 (CET)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
by proxmox-new.maurer-it.com (Proxmox) with ESMTP id AC3B44581E
for <pbs-devel@lists.proxmox.com>; Tue, 2 Mar 2021 16:31:20 +0100 (CET)
From: Dominik Csapak <d.csapak@proxmox.com>
To: pbs-devel@lists.proxmox.com
Date: Tue, 2 Mar 2021 16:31:20 +0100
Message-Id: <20210302153120.31213-1-d.csapak@proxmox.com>
X-Mailer: git-send-email 2.20.1
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results: 0
AWL 0.201 Adjusted score from AWL reputation of From: address
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/,
medium trust
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
information. [rest.rs]
Subject: [pbs-devel] [RFC PATCH proxmox-backup] server/rest: disallow
non-protected api calls in privileged environment
X-BeenThere: pbs-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox Backup Server development discussion
<pbs-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pbs-devel>,
<mailto:pbs-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pbs-devel/>
List-Post: <mailto:pbs-devel@lists.proxmox.com>
List-Help: <mailto:pbs-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel>,
<mailto:pbs-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 02 Mar 2021 15:31:22 -0000
to prevent potential abuse of non-protected api calls as root
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
this is a rather theoretical security improvement, i am not sure if we
want this? it would only guard against an unprotected api call that somehow
allows code execution. this could then be abused to connect to the
daemon and reabuse the same api call, but with root permissions
also if we want this, maybe this would be good to have in pve too?
src/server/rest.rs | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/server/rest.rs b/src/server/rest.rs
index 9bf494fd..6b170b7f 100644
--- a/src/server/rest.rs
+++ b/src/server/rest.rs
@@ -750,6 +750,9 @@ async fn handle_request(
let result = if api_method.protected && env_type == RpcEnvironmentType::PUBLIC {
proxy_protected_request(api_method, parts, body, peer).await
+ } else if !api_method.protected && env_type == RpcEnvironmentType::PRIVILEGED {
+ let err = http_err!(FORBIDDEN, "invalid server request");
+ return Ok((formatter.format_error)(err));
} else {
handle_api_request(rpcenv, api_method, formatter, parts, body, uri_param).await
};
--
2.20.1