[PATCH manager/access-control 0/3] fix #7513: fine-grained ACL for node certificates

[Jakob Klocker <j.klocker@proxmox.com>]

Managing node certificates currently requires broad /nodes/{node}
permissions, which violates the least-privilege principle. This
series adds /nodes/{node}/certificates as a dedicated ACL path and
moves the relevant permission checks onto it, so certificate
management can be done without granting node-wide rights.

The pve-access-control patch registers the new ACL path and must be
applied first. The pve-manager patches depend on it for the API
permission checks and the GUI path selector.


pve-access-control:

Jakob Klocker (1):
  fix #7513: acl: allow ACL access to /nodes/{node}/certificates path

  src/PVE/AccessControl.pm           |  1 +
  1 files changed, 1 insertions(+), 0 deletions(-)

pve-manager:

Jakob Klocker (2):
  fix #7513: api: certs: change ACL on certificates path
  fix #7513: ui: perm path store: add per-node certificates ACL path

 PVE/API2/ACME.pm                   |  6 +++---
 PVE/API2/Certificates.pm           |  4 ++--
 www/manager6/data/PermPathStore.js | 11 +++++++++--
 3 files changed, 14 insertions(+), 7 deletions(-)

-- 
2.47.3