From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 521AB1FF165 for ; Thu, 17 Jul 2025 15:36:12 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9805A3ADDA; Thu, 17 Jul 2025 15:37:17 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Thu, 17 Jul 2025 15:36:49 +0200 Message-ID: <20250717133711.84715-2-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.2 In-Reply-To: <20250717133711.84715-1-f.ebner@proxmox.com> References: <20250717133711.84715-1-f.ebner@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.028 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [accesscontrol.pm, perm-test1.pl] Subject: [pve-devel] [PATCH access-control 1/9] add VM.GuestAgent privileges X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" The privilege VM.Monitor has a very ambiguous name and is planned to be dropped. Most of the API endpoints using it are for the QEMU guest agent commands. Introduce dedicated, more fine-grained privileges for those. There is a basic VM.GuestAgent.Audit privilege for read-only, informational commands. There are dedicated privileges VM.GuestAgent.File{Read,Write} for the file-{read,write} commands. There is a separate VM.GuestAgent.FileSystemMgmt privilege for filesystem freeze, thaw and trim. The VM.GuestAgent.Unrestricted privilege is to allow all guest agent operations, in particular also execution of arbitrary commands with guest-exec. Signed-off-by: Fiona Ebner --- src/PVE/AccessControl.pm | 6 +++++- src/test/perm-test1.pl | 8 ++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm index cebb76f..3e12850 100644 --- a/src/PVE/AccessControl.pm +++ b/src/PVE/AccessControl.pm @@ -1059,6 +1059,7 @@ my $privgroups = { 'VM.Config.Options', # covers all other things 'VM.Allocate', 'VM.Clone', + 'VM.GuestAgent.Unrestricted', 'VM.Migrate', 'VM.Monitor', 'VM.Snapshot', @@ -1069,10 +1070,13 @@ my $privgroups = { 'VM.Config.Cloudinit', 'VM.Console', 'VM.Backup', + 'VM.GuestAgent.FileRead', + 'VM.GuestAgent.FileSystemMgmt', + 'VM.GuestAgent.FileWrite', 'VM.PowerMgmt', ], audit => [ - 'VM.Audit', + 'VM.Audit', 'VM.GuestAgent.Audit', ], }, Sys => { diff --git a/src/test/perm-test1.pl b/src/test/perm-test1.pl index 69b396e..bf01ac6 100755 --- a/src/test/perm-test1.pl +++ b/src/test/perm-test1.pl @@ -65,7 +65,9 @@ check_permission( '' # sorted, comma-separated expected privilege string . 'VM.Allocate,VM.Audit,VM.Backup,VM.Clone,VM.Config.CDROM,VM.Config.CPU,VM.Config.Cloudinit,' . 'VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,' - . 'VM.Console,VM.Migrate,VM.Monitor,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback', + . 'VM.Console,VM.GuestAgent.Audit,VM.GuestAgent.FileRead,VM.GuestAgent.FileSystemMgmt,' + . 'VM.GuestAgent.FileWrite,VM.GuestAgent.Unrestricted,VM.Migrate,VM.Monitor,VM.PowerMgmt,' + . 'VM.Snapshot,VM.Snapshot.Rollback', ); # Administrator -> Permissions.Modify! check_permission( @@ -83,7 +85,9 @@ check_permission( . 'User.Modify,' . 'VM.Allocate,VM.Audit,VM.Backup,VM.Clone,VM.Config.CDROM,VM.Config.CPU,VM.Config.Cloudinit,' . 'VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,' - . 'VM.Console,VM.Migrate,VM.Monitor,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback', + . 'VM.Console,VM.GuestAgent.Audit,VM.GuestAgent.FileRead,VM.GuestAgent.FileSystemMgmt,' + . 'VM.GuestAgent.FileWrite,VM.GuestAgent.Unrestricted,VM.Migrate,VM.Monitor,VM.PowerMgmt,' + . 'VM.Snapshot,VM.Snapshot.Rollback', ); check_roles('max@pve', '/vms/200', 'storage_manager'); -- 2.47.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel