From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <d.csapak@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id 0124E6B7B8
for <pve-devel@lists.proxmox.com>; Wed, 4 Aug 2021 12:51:45 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id ECCC01E325
for <pve-devel@lists.proxmox.com>; Wed, 4 Aug 2021 12:51:14 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
[94.136.29.106])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS id 6B7131E306
for <pve-devel@lists.proxmox.com>; Wed, 4 Aug 2021 12:51:13 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 357B042DA1
for <pve-devel@lists.proxmox.com>; Wed, 4 Aug 2021 12:51:13 +0200 (CEST)
From: Dominik Csapak <d.csapak@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Wed, 4 Aug 2021 12:51:07 +0200
Message-Id: <20210804105111.183355-2-d.csapak@proxmox.com>
X-Mailer: git-send-email 2.30.2
In-Reply-To: <20210804105111.183355-1-d.csapak@proxmox.com>
References: <20210804105111.183355-1-d.csapak@proxmox.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results: 0
AWL 0.474 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
information. [config.pm, lxc.pm]
Subject: [pve-devel] [PATCH container v2 1/3] add old config and
unprivileged to check_ct_modify_config_perm
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Wed, 04 Aug 2021 10:51:45 -0000
we'll need that for checking the features more granularly
for it to work correctly, we have to move the permission checks
into the 'lock_config' sub, since we now also need to check the current
config and it could change between the permission check and the lock
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
src/PVE/API2/LXC.pm | 6 +--
src/PVE/API2/LXC/Config.pm | 95 +++++++++++++++++++-------------------
src/PVE/LXC.pm | 2 +-
3 files changed, 52 insertions(+), 51 deletions(-)
diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index b929481..afef7ec 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -254,7 +254,7 @@ __PACKAGE__->register_method({
my $ostemplate = extract_param($param, 'ostemplate');
my $storage = extract_param($param, 'storage') // 'local';
- PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, $param, []);
+ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, undef, $param, [], $unprivileged);
my $storage_cfg = cfs_read_file("storage.cfg");
@@ -1679,8 +1679,6 @@ __PACKAGE__->register_method({
die "no options specified\n" if !scalar(keys %$param);
- PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
-
my $storage_cfg = cfs_read_file("storage.cfg");
my $code = sub {
@@ -1688,6 +1686,8 @@ __PACKAGE__->register_method({
my $conf = PVE::LXC::Config->load_config($vmid);
PVE::LXC::Config->check_lock($conf);
+ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $conf, $param, [], $conf->{unprivileged});
+
PVE::Tools::assert_if_modified($digest, $conf->{digest});
my $running = PVE::LXC::check_running($vmid);
diff --git a/src/PVE/API2/LXC/Config.pm b/src/PVE/API2/LXC/Config.pm
index 73fec36..1fec048 100644
--- a/src/PVE/API2/LXC/Config.pm
+++ b/src/PVE/API2/LXC/Config.pm
@@ -144,62 +144,63 @@ __PACKAGE__->register_method({
my $revert_str = extract_param($param, 'revert');
my @revert = PVE::Tools::split_list($revert_str);
- PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, {}, [@delete]);
- PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, {}, [@revert]);
+ my $code = sub {
- foreach my $opt (@revert) {
- raise_param_exc({ revert => "unknown option '$opt'" })
- if !PVE::LXC::Config->option_exists($opt);
+ my $conf = PVE::LXC::Config->load_config($vmid);
+ PVE::LXC::Config->check_lock($conf);
- raise_param_exc({ revert => "you can't use '-$opt' and '-revert $opt' at the same time" })
- if defined($param->{$opt});
- }
+ PVE::Tools::assert_if_modified($digest, $conf->{digest});
- foreach my $opt (@delete) {
- raise_param_exc({ delete => "unknown option '$opt'" })
- if !PVE::LXC::Config->option_exists($opt);
+ my $unprivileged = $conf->{unprivileged};
+ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $conf, {}, [@delete], $unprivileged);
+ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $conf, {}, [@revert], $unprivileged);
- raise_param_exc({ delete => "you can't use '-$opt' and -delete $opt' at the same time" })
- if defined($param->{$opt});
+ foreach my $opt (@revert) {
+ raise_param_exc({ revert => "unknown option '$opt'" })
+ if !PVE::LXC::Config->option_exists($opt);
- raise_param_exc({ delete => "you can't use '-delete $opt' and '-revert $opt' at the same time" })
- if grep(/^$opt$/, @revert);
- }
+ raise_param_exc({ revert => "you can't use '-$opt' and '-revert $opt' at the same time" })
+ if defined($param->{$opt});
+ }
- PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
-
- my $storage_cfg = PVE::Storage::config();
-
- my $repl_conf = PVE::ReplicationConfig->new();
- my $is_replicated = $repl_conf->check_for_existing_jobs($vmid, 1);
- if ($is_replicated) {
- PVE::LXC::Config->foreach_volume($param, sub {
- my ($opt, $mountpoint) = @_;
- my $volid = $mountpoint->{volume};
- return if !$volid || !($mountpoint->{replicate}//1);
- if ($mountpoint->{type} eq 'volume') {
- my ($storeid, $format);
- if ($volid =~ $PVE::LXC::NEW_DISK_RE) {
- $storeid = $1;
- $format = $mountpoint->{format} || PVE::Storage::storage_default_format($storage_cfg, $storeid);
- } else {
- ($storeid, undef) = PVE::Storage::parse_volume_id($volid, 1);
- $format = (PVE::Storage::parse_volname($storage_cfg, $volid))[6];
- }
- return if PVE::Storage::storage_can_replicate($storage_cfg, $storeid, $format);
- my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
- return if $scfg->{shared};
- }
- die "cannot add non-replicatable volume to a replicated VM\n";
- });
- }
+ foreach my $opt (@delete) {
+ raise_param_exc({ delete => "unknown option '$opt'" })
+ if !PVE::LXC::Config->option_exists($opt);
- my $code = sub {
+ raise_param_exc({ delete => "you can't use '-$opt' and -delete $opt' at the same time" })
+ if defined($param->{$opt});
- my $conf = PVE::LXC::Config->load_config($vmid);
- PVE::LXC::Config->check_lock($conf);
+ raise_param_exc({ delete => "you can't use '-delete $opt' and '-revert $opt' at the same time" })
+ if grep(/^$opt$/, @revert);
+ }
- PVE::Tools::assert_if_modified($digest, $conf->{digest});
+ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $conf, $param, [], $unprivileged);
+
+ my $storage_cfg = PVE::Storage::config();
+
+ my $repl_conf = PVE::ReplicationConfig->new();
+ my $is_replicated = $repl_conf->check_for_existing_jobs($vmid, 1);
+ if ($is_replicated) {
+ PVE::LXC::Config->foreach_volume($param, sub {
+ my ($opt, $mountpoint) = @_;
+ my $volid = $mountpoint->{volume};
+ return if !$volid || !($mountpoint->{replicate}//1);
+ if ($mountpoint->{type} eq 'volume') {
+ my ($storeid, $format);
+ if ($volid =~ $PVE::LXC::NEW_DISK_RE) {
+ $storeid = $1;
+ $format = $mountpoint->{format} || PVE::Storage::storage_default_format($storage_cfg, $storeid);
+ } else {
+ ($storeid, undef) = PVE::Storage::parse_volume_id($volid, 1);
+ $format = (PVE::Storage::parse_volname($storage_cfg, $volid))[6];
+ }
+ return if PVE::Storage::storage_can_replicate($storage_cfg, $storeid, $format);
+ my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
+ return if $scfg->{shared};
+ }
+ die "cannot add non-replicatable volume to a replicated VM\n";
+ });
+ }
my $running = PVE::LXC::check_running($vmid);
diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 139f901..32a2127 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1242,7 +1242,7 @@ sub template_create {
}
sub check_ct_modify_config_perm {
- my ($rpcenv, $authuser, $vmid, $pool, $newconf, $delete) = @_;
+ my ($rpcenv, $authuser, $vmid, $pool, $oldconf, $newconf, $delete, $unprivileged) = @_;
return 1 if $authuser eq 'root@pam';
my $storage_cfg = PVE::Storage::config();
--
2.30.2