[PATCH manager v4 0/2] fix #6735: api: pci: allow mdevscan access via mapping permissions

[PATCH manager v4 0/2] fix #6735: api: pci: allow mdevscan access via mapping permissions

[Elias Huhsovitz]

This series allows users who have been granted Mapping.Use
(or Mapping.Modify / Mapping.Audit) on a specific PCI mapping to list
the mediated device (mdev) types for that mapping without requiring
global Sys.Audit or Sys.Modify privileges on the entire cluster.

In multi‑team environments where access is compartmentalized via
resource pools and PCI mappings, the previous requirement forced
administrators to grant overly broad permissions for GPU usage.
By checking mapping‑specific permissions when a mapping name is
supplied, the patch enables non‑administrative users to select and use
vGPU types for their assigned hardware.

Patch 1/2 makes the necessary logical change for fixing #6735.
Patch 2/2 utilizes a new constant parameter for the `pci_scan` endpoint

Changes v3->v4
--------------
* factor out global permissions into constant
* de-rerence global permissions array when passing it to
  `raise_perm_exc`
* add optional second patch to utilize global permissions constant for
  `pci_scan` endpoint

Changes v2->v3
--------------
* re-introduce else-statement in API handler
* move permissions checks into respective logical branches
  (previously sepate sesection before core code)
* update commit message

Changes v1->v2
--------------
* Allow all users in the declarative API permissions.
* Implement ACL check in API handler by calling
  check_any and raise_perm_exc.
* Remove else statement in API handler, since return statement
  provides implicit branching
* update commit message

Previous Versions
-----------------
v3: https://lore.proxmox.com/pve-devel/20260903121143.145841-1-e.huhsovitz@proxmox.com/
v2: https://lore.proxmox.com/pve-devel/20260827112525.154445-1-e.huhsovitz@proxmox.com/
v1: https://lore.proxmox.com/pve-devel/20260824112610.148089-1-e.huhsovitz@proxmox.com/

Summary of Changes
------------------
Elias Huhsovitz (2):
  fix #6735: api: pci: allow mdevscan access via mapping permissions
  api: pci: utilize constant perm variable for pci_scan

 PVE/API2/Hardware/PCI.pm | 47 ++++++++++++++++++++++++++++++----------
 1 file changed, 35 insertions(+), 12 deletions(-)

-- 
2.47.3

[PATCH manager v4 1/2] fix #6735: api: pci: allow mdevscan access via mapping permissions

[Elias Huhsovitz]

The mdevscan endpoint requires Sys.Audit or Sys.Modify on '/'. This
blocks non-admin users from listing mediated device types for a PCI
mapping, even when they hold Mapping.Use on that mapping.

Check the permission in the API handler based on the parameter type: For
a raw PCI ID, require Sys.Audit or Sys.Modify on '/'. For a mapping,
require Sys.Audit or Sys.Modify on '/', or fall back to requiring
Mapping.Use, Mapping.Modify or Mapping.Audit on the specific mapping
path.

Set the endpoint permission to 'user => all' so the handler performs the
type-dependent check. This keeps raw PCI IDs, which are not valid ACL
paths, out of the declarative ACL evaluation.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
Reviewed-by: Dominik Csapak <d.csapak@proxmox.com>
Tested-by: Dominik Csapak <d.csapak@proxmox.com>
---
 PVE/API2/Hardware/PCI.pm | 44 ++++++++++++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/PVE/API2/Hardware/PCI.pm b/PVE/API2/Hardware/PCI.pm
index 36b9741b..eb83824f 100644
--- a/PVE/API2/Hardware/PCI.pm
+++ b/PVE/API2/Hardware/PCI.pm
@@ -3,13 +3,17 @@ package PVE::API2::Hardware::PCI;
 use strict;
 use warnings;
 
+use PVE::Exception qw(raise raise_perm_exc);
 use PVE::JSONSchema qw(get_standard_option);
 
 use PVE::QemuServer::PCI::Mdev;
 use PVE::RESTHandler;
+use PVE::RPCEnvironment;
 
 use base qw(PVE::RESTHandler);
 
+use constant GLOBAL_PERMS => ['Sys.Audit', 'Sys.Modify'];
+
 my $default_class_blacklist = "05;06;0b";
 
 __PACKAGE__->register_method({
@@ -180,7 +184,11 @@ __PACKAGE__->register_method({
     protected => 1,
     proxyto => "node",
     permissions => {
-        check => ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1],
+        description =>
+            "For a PCI ID, requires 'Sys.Audit' or 'Sys.Modify' on '/'. For a mapping,"
+            . " requires the same global permissions, or 'Mapping.Use', 'Mapping.Modify'"
+            . ", or 'Mapping.Audit' on '/mapping/pci/<id>'.",
+        user => 'all',
     },
     parameters => {
         additionalProperties => 0,
@@ -222,20 +230,35 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
-        if ($param->{'pci-id-or-mapping'} =~
-            m/^(?:[0-9a-fA-F]{4}:)?[0-9a-fA-F]{2}:[0-9a-fA-F]{2}\.[0-9a-fA-F]$/
-        ) {
-            return PVE::QemuServer::PCI::Mdev::get_mdev_types($param->{'pci-id-or-mapping'}); # PCI ID
+        my $id = $param->{'pci-id-or-mapping'};
+        my $is_pci_id =
+            $id =~ m/^(?:[0-9a-fA-F]{4}:)?[0-9a-fA-F]{2}:[0-9a-fA-F]{2}\.[0-9a-fA-F]$/;
+
+        my $rpcenv = PVE::RPCEnvironment::get();
+        my $authuser = $rpcenv->get_user();
+
+        my $has_global_perms = $rpcenv->check_any($authuser, '/', GLOBAL_PERMS, 1);
+
+        if ($is_pci_id) {
+            raise_perm_exc("/, " . join("|", GLOBAL_PERMS->@*)) if !$has_global_perms;
+
+            return PVE::QemuServer::PCI::Mdev::get_mdev_types($id);
         } else {
-            my $mapping = $param->{'pci-id-or-mapping'};
+            if (!$has_global_perms) {
+                $rpcenv->check_any(
+                    $authuser,
+                    "/mapping/pci/$id",
+                    ['Mapping.Use', 'Mapping.Modify', 'Mapping.Audit'],
+                );
+            }
 
             my $types = {};
-            my $devices = PVE::Mapping::PCI::find_on_current_node($mapping);
+            my $devices = PVE::Mapping::PCI::find_on_current_node($id);
             for my $device ($devices->@*) {
-                my $id = $device->{path};
-                next if $id =~ m/;/; # mdev not supported for multifunction devices
+                my $dev_id = $device->{path};
+                next if $dev_id =~ m/;/; # mdev not supported for multifunction devices
 
-                my $device_types = PVE::QemuServer::PCI::Mdev::get_mdev_types($id);
+                my $device_types = PVE::QemuServer::PCI::Mdev::get_mdev_types($dev_id);
 
                 for my $type_definition ($device_types->@*) {
                     my $type = $type_definition->{type};
@@ -247,6 +270,5 @@ __PACKAGE__->register_method({
 
             return [sort { $a->{type} cmp $b->{type} } values($types->%*)];
         }
-
     },
 });
-- 
2.47.3

[PATCH manager v4 2/2] api: pci: utilize constant perm variable for pci_scan

[Elias Huhsovitz]

The previous commit factored out the global permission list, i.e.,
['Sys.Audit', 'Sys.Modify']. The `pci_scan` endpoint also utilizes the
same global permissions.

Replace the hard-coded permission check in the `pci_scan` endpoint with
the new GLOBAL_PERMS constant.

Add brief permission description.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
---
 PVE/API2/Hardware/PCI.pm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/PVE/API2/Hardware/PCI.pm b/PVE/API2/Hardware/PCI.pm
index eb83824f..83fafcb8 100644
--- a/PVE/API2/Hardware/PCI.pm
+++ b/PVE/API2/Hardware/PCI.pm
@@ -24,7 +24,8 @@ __PACKAGE__->register_method({
     protected => 1,
     proxyto => "node",
     permissions => {
-        check => ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1],
+        description => "Requires 'Sys.Audit' or 'Sys.Modify' on '/'.",
+        check => ['perm', '/', GLOBAL_PERMS, any => 1],
     },
     parameters => {
         additionalProperties => 0,
-- 
2.47.3