all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Dominik Csapak <d.csapak@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH qemu-server v7 1/1] api: update: check 'admin' tags privileges
Date: Tue, 21 Jun 2022 11:19:57 +0200	[thread overview]
Message-ID: <20220621092012.1776825-10-d.csapak@proxmox.com> (raw)
In-Reply-To: <20220621092012.1776825-1-d.csapak@proxmox.com>

normal tags require 'VM.Config.Options' on the VM, admin tags require
'Sys.Modify' on '/'

a user can set/delete/reorder tags, as long as no admin tags get
added/removed

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 PVE/API2/Qemu.pm  | 56 ++++++++++++++++++++++++++++++++++++++++++++++-
 PVE/QemuServer.pm |  3 ++-
 2 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 99b426e..37b56c8 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -519,7 +519,6 @@ my $generaloptions = {
     'startup' => 1,
     'tdf' => 1,
     'template' => 1,
-    'tags' => 1,
 };
 
 my $vmpoweroptions = {
@@ -589,6 +588,7 @@ my $check_vm_modify_config_perm = sub {
 	next if PVE::QemuServer::is_valid_drivename($opt);
 	next if $opt eq 'cdrom';
 	next if $opt =~ m/^(?:unused|serial|usb)\d+$/;
+	next if $opt eq 'tags';
 
 
 	if ($cpuoptions->{$opt} || $opt =~ m/^numa\d+$/) {
@@ -1559,6 +1559,27 @@ my $update_vm_api  = sub {
 		    }
 		    PVE::QemuConfig->add_to_pending_delete($conf, $opt, $force);
 		    PVE::QemuConfig->write_config($vmid, $conf);
+		} elsif ($opt eq 'tags') {
+		    my $check_admin = 0;
+		    my $check_options = 0;
+		    foreach my $tag (PVE::Tools::split_list($val)) {
+			if (PVE::JSONSchema::is_admin_pve_tag($tag)) {
+			    $check_admin = 1;
+			} else {
+			    $check_options = 1;
+			}
+		    }
+
+		    if ($check_admin) {
+			$rpcenv->check($authuser, "/", ['Sys.Modify']);
+		    }
+
+		    if ($check_options) {
+			$rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Options']);
+		    }
+
+		    delete $conf->{$opt};
+		    PVE::QemuConfig->write_config($vmid, $conf);
 		} else {
 		    PVE::QemuConfig->add_to_pending_delete($conf, $opt, $force);
 		    PVE::QemuConfig->write_config($vmid, $conf);
@@ -1619,6 +1640,39 @@ my $update_vm_api  = sub {
 			die "only root can modify '$opt' config for real devices\n";
 		    }
 		    $conf->{pending}->{$opt} = $param->{$opt};
+		} elsif ($opt eq 'tags') {
+		    my $check_admin = 0;
+		    my $check_user = 0;
+
+		    my $old_tags = {};
+		    my $new_tags = {};
+
+		    map { $old_tags->{$_} = 1 } PVE::Tools::split_list($conf->{$opt});
+		    map { $new_tags->{$_} = 1 } PVE::Tools::split_list($param->{$opt});
+
+		    my $check_tags = sub {
+			my ($a, $b) = @_;
+			foreach my $tag (keys %$a) {
+			    next if $b->{$tag};
+			    if (PVE::JSONSchema::is_admin_pve_tag($tag)) {
+				$check_admin = 1;
+			    } else {
+				$check_user = 1;
+			    }
+			}
+		    };
+
+		    $check_tags->($old_tags, $new_tags);
+		    $check_tags->($new_tags, $old_tags);
+
+		    if ($check_admin) {
+			$rpcenv->check($authuser, "/", ['VM.Config.Options']);
+		    }
+
+		    if ($check_user) {
+			$rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Options']);
+		    }
+		    $conf->{pending}->{$opt} = $param->{$opt};
 		} else {
 		    $conf->{pending}->{$opt} = $param->{$opt};
 
diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index b3964bc..48247cc 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -698,7 +698,8 @@ EODESCR
     },
     tags => {
 	type => 'string', format => 'pve-tag-list',
-	description => 'Tags of the VM. This is only meta information.',
+	description => 'Tags of the VM. This is only meta information. Prefixing a tag with'.
+	    "'+' marks it as an admin tag and can only be set with 'Sys.Modify' on '/'.",
 	optional => 1,
     },
     rng0 => {
-- 
2.30.2





  parent reply	other threads:[~2022-06-21  9:20 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-21  9:19 [pve-devel] [PATCH common/cluster/qemu/container/wt/manager v7] add tags to ui Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH common v7 1/2] JSONSchema: refactor tag regex Dominik Csapak
2022-09-20 11:37   ` [pve-devel] applied: " Thomas Lamprecht
2022-06-21  9:19 ` [pve-devel] [PATCH common v7 2/2] JSONSchema: pve-tag: add syntax for 'admin' tags Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH cluster v7 1/3] add CFS_IPC_GET_GUEST_CONFIG_PROPERTIES method Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH cluster v7 2/3] Cluster: add get_guest_config_properties Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH cluster v7 3/3] datacenter.cfg: add option for tag-style Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH widget-toolkit v7 1/3] add tag related helpers Dominik Csapak
2022-09-14 14:15   ` Aaron Lauterer
2022-06-21  9:19 ` [pve-devel] [PATCH widget-toolkit v7 2/3] add class for 'admin' tags Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH widget-toolkit v7 3/3] Toolkit: add override for Ext.dd.DragDropManager Dominik Csapak
2022-06-21  9:19 ` Dominik Csapak [this message]
2022-09-14 14:15   ` [pve-devel] [PATCH qemu-server v7 1/1] api: update: check 'admin' tags privileges Aaron Lauterer
2022-09-15 11:46     ` Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH container v7 1/1] check_ct_modify_config_perm: " Dominik Csapak
2022-06-21  9:19 ` [pve-devel] [PATCH manager v7 01/14] api: /cluster/resources: add tags to returned properties Dominik Csapak
2022-09-14 14:15   ` Aaron Lauterer
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 02/14] api: /version: add 'tag-style' Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 03/14] ui: parse and save tag color overrides from /version Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 04/14] ui: tree/ResourceTree: collect tags on update Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 05/14] ui: add form/TagColorGrid Dominik Csapak
2022-09-14 14:15   ` Aaron Lauterer
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 06/14] ui: dc/OptionView: add editors for tag settings Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 07/14] ui: add form/Tag Dominik Csapak
2022-09-14 14:15   ` Aaron Lauterer
2022-09-14 14:36     ` Aaron Lauterer
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 08/14] ui: add form/TagEdit.js Dominik Csapak
2022-09-14 14:15   ` Aaron Lauterer
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 09/14] ui: {lxc, qemu}/Config: show Tags and make them editable Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 10/14] ui: tree/ResourceTree: show Tags in tree Dominik Csapak
2022-09-14 14:15   ` Aaron Lauterer
2022-09-15 11:54     ` Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 11/14] ui: form/GlobalSearchField: display tags and allow to search for them Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 12/14] ui: form/Tag: add 'admin-tag' class to admin tags Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 13/14] ui: ResourceGrid: render tags Dominik Csapak
2022-06-21  9:20 ` [pve-devel] [PATCH manager v7 14/14] ui: form/Tag(Edit): add drag & drop when editing tags Dominik Csapak
2022-09-14 14:15   ` Aaron Lauterer
2022-09-15 11:56     ` Dominik Csapak
2022-09-14 14:34 ` [pve-devel] [PATCH common/cluster/qemu/container/wt/manager v7] add tags to ui Aaron Lauterer
2022-09-16  7:19 ` Thomas Lamprecht
2022-09-16  7:50   ` Dominik Csapak

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220621092012.1776825-10-d.csapak@proxmox.com \
    --to=d.csapak@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal