[PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[Fabian Grünbichler]

the wrong path was copied over from the node shell, and since there is no
"node" parameter here, calls as non-root will fail with 403..

Fixes: 525c8c49 "server: add termproxy and vncwebsocket calls for qemu guests"

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
403 if the API schema is actually invalid might be something to catch
lower in the stack as well?

 server/src/api/pve/lxc.rs  | 4 ++--
 server/src/api/pve/qemu.rs | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
index 6183f62d..ca32eb84 100644
--- a/server/src/api/pve/lxc.rs
+++ b/server/src/api/pve/lxc.rs
@@ -807,9 +807,9 @@ pub const API_METHOD_LXC_WEBSOCKET: ApiMethod = ApiMethod::new(
     ),
 )
 .access(
-    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
+    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
     &Permission::Privilege(
-        &["resource", "{remote}", "node", "{node}"],
+        &["resource", "{remote}", "guest", "{vmid}"],
         PRIV_SYS_CONSOLE,
         false,
     ),
diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
index 65de6389..5d01e69e 100644
--- a/server/src/api/pve/qemu.rs
+++ b/server/src/api/pve/qemu.rs
@@ -895,9 +895,9 @@ pub const API_METHOD_QEMU_WEBSOCKET: ApiMethod = ApiMethod::new(
     ),
 )
 .access(
-    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
+    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
     &Permission::Privilege(
-        &["resource", "{remote}", "node", "{node}"],
+        &["resource", "{remote}", "guest", "{vmid}"],
         PRIV_SYS_CONSOLE,
         false,
     ),
-- 
2.47.3

Re: [PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[Dominik Csapak]

On 7/8/26 12:40 PM, Fabian Grünbichler wrote:
> the wrong path was copied over from the node shell, and since there is no
> "node" parameter here, calls as non-root will fail with 403..
> 
> Fixes: 525c8c49 "server: add termproxy and vncwebsocket calls for qemu guests"
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
> 403 if the API schema is actually invalid might be something to catch
> lower in the stack as well?

i guess the substitution fails during privilege check in proxmox-router
and that triggers a 403 higher up in the stack?

since that must be const, maybe there can be a compile time check that
the parameters must exist here?

> 
>   server/src/api/pve/lxc.rs  | 4 ++--
>   server/src/api/pve/qemu.rs | 4 ++--
>   2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
> index 6183f62d..ca32eb84 100644
> --- a/server/src/api/pve/lxc.rs
> +++ b/server/src/api/pve/lxc.rs
> @@ -807,9 +807,9 @@ pub const API_METHOD_LXC_WEBSOCKET: ApiMethod = ApiMethod::new(
>       ),
>   )
>   .access(
> -    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
> +    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
>       &Permission::Privilege(
> -        &["resource", "{remote}", "node", "{node}"],
> +        &["resource", "{remote}", "guest", "{vmid}"],
>           PRIV_SYS_CONSOLE,
>           false,
>       ),
> diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
> index 65de6389..5d01e69e 100644
> --- a/server/src/api/pve/qemu.rs
> +++ b/server/src/api/pve/qemu.rs
> @@ -895,9 +895,9 @@ pub const API_METHOD_QEMU_WEBSOCKET: ApiMethod = ApiMethod::new(
>       ),
>   )
>   .access(
> -    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
> +    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
>       &Permission::Privilege(
> -        &["resource", "{remote}", "node", "{node}"],
> +        &["resource", "{remote}", "guest", "{vmid}"],
>           PRIV_SYS_CONSOLE,
>           false,
>       ),