Re: [PATCH manager] fix #6735: api: pci: extend mdevscan persmissions for mappings

[Dominik Csapak <d.csapak@proxmox.com>]

hi,

while testing this, i saw the following errors in the syslog:

pveproxy[888583]: Failed to normalize '/mapping/pci/0000:08:00.0'
pveproxy[888583]: internal error: ACL check called for undefined ACL path!

i guess that something trips up the acl path normalize code (the '.' or 
the ':' probably?)

also checking the id for the mapping path is not really correct.
so i think the easiest way here would be to allow the api call
for all users, and explicitely check the permissions in the api
handler itself, after deciding if it's a mapping or a pci id.

you can use 'raise_perm_exc' then to give the user the correct
error message too.

(we do this often when the permissions depend on the actual parameter)

On 8/24/26 1:25 PM, Elias Huhsovitz wrote:
> The mdevscan endpoint currently requires Sys.Audit or Sys.Modify on the
> root path (/). This prevents non-admin users from querying available
> mediated device types for a PCI mapping, even if they have explicit
> Mapping.Use permissions on that specific mapping.
> 
> Update the permission check to allow access if the user holds
> Mapping.Use, Mapping.Modify, or Mapping.Audit on the respective mapping
> path (i.e., /mapping/pci/{mapping}). This aligns the `GET
> /nodes/{node}/hardware/pci/{pci-id-or-mapping}/mdev` endpoint with the
> `GET /cluster/mapping/pci/{id}` endpoint.
> 
> Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
> ---
>   PVE/API2/Hardware/PCI.pm | 13 ++++++++++++-
>   1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/PVE/API2/Hardware/PCI.pm b/PVE/API2/Hardware/PCI.pm
> index 36b9741b..de62bcd8 100644
> --- a/PVE/API2/Hardware/PCI.pm
> +++ b/PVE/API2/Hardware/PCI.pm
> @@ -180,7 +180,18 @@ __PACKAGE__->register_method({
>       protected => 1,
>       proxyto => "node",
>       permissions => {
> -        check => ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1],
> +        description => "Requires 'Sys.Audit' or 'Sys.Modify' on '/' for PCI IDs,"
> +            . " or mapping permissions on the respective mapping.",
> +        check => [
> +            'or',
> +            ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1],
> +            [
> +                'perm',
> +                '/mapping/pci/{pci-id-or-mapping}',
> +                ['Mapping.Use', 'Mapping.Modify', 'Mapping.Audit'],
> +                any => 1,
> +            ],
> +        ],
>       },
>       parameters => {
>           additionalProperties => 0,