[PATCH manager] fix #6735: api: pci: extend mdevscan persmissions for mappings

[PATCH manager] fix #6735: api: pci: extend mdevscan persmissions for mappings

[Elias Huhsovitz]

The mdevscan endpoint currently requires Sys.Audit or Sys.Modify on the
root path (/). This prevents non-admin users from querying available
mediated device types for a PCI mapping, even if they have explicit
Mapping.Use permissions on that specific mapping.

Update the permission check to allow access if the user holds
Mapping.Use, Mapping.Modify, or Mapping.Audit on the respective mapping
path (i.e., /mapping/pci/{mapping}). This aligns the `GET
/nodes/{node}/hardware/pci/{pci-id-or-mapping}/mdev` endpoint with the
`GET /cluster/mapping/pci/{id}` endpoint.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
---
 PVE/API2/Hardware/PCI.pm | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/PVE/API2/Hardware/PCI.pm b/PVE/API2/Hardware/PCI.pm
index 36b9741b..de62bcd8 100644
--- a/PVE/API2/Hardware/PCI.pm
+++ b/PVE/API2/Hardware/PCI.pm
@@ -180,7 +180,18 @@ __PACKAGE__->register_method({
     protected => 1,
     proxyto => "node",
     permissions => {
-        check => ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1],
+        description => "Requires 'Sys.Audit' or 'Sys.Modify' on '/' for PCI IDs,"
+            . " or mapping permissions on the respective mapping.",
+        check => [
+            'or',
+            ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1],
+            [
+                'perm',
+                '/mapping/pci/{pci-id-or-mapping}',
+                ['Mapping.Use', 'Mapping.Modify', 'Mapping.Audit'],
+                any => 1,
+            ],
+        ],
     },
     parameters => {
         additionalProperties => 0,
-- 
2.47.3