From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <t.lamprecht@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by lists.proxmox.com (Postfix) with ESMTPS id 55F8E707CC
 for <pve-devel@lists.proxmox.com>; Fri,  3 Jun 2022 14:03:56 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
 by firstgate.proxmox.com (Proxmox) with ESMTP id 4D50674BC
 for <pve-devel@lists.proxmox.com>; Fri,  3 Jun 2022 14:03:56 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
 [94.136.29.106])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by firstgate.proxmox.com (Proxmox) with ESMTPS id CA22374B1
 for <pve-devel@lists.proxmox.com>; Fri,  3 Jun 2022 14:03:55 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
 by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 96BB143A19
 for <pve-devel@lists.proxmox.com>; Fri,  3 Jun 2022 14:03:55 +0200 (CEST)
Message-ID: <b448641b-a5bc-f5a4-a834-b5df26aa7fc7@proxmox.com>
Date: Fri, 3 Jun 2022 14:03:54 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101
 Thunderbird/101.0
Content-Language: en-GB
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>,
 =?UTF-8?Q?Fabian_Gr=c3=bcnbichler?= <f.gruenbichler@proxmox.com>
References: <20220603115049.1908792-1-f.gruenbichler@proxmox.com>
From: Thomas Lamprecht <t.lamprecht@proxmox.com>
In-Reply-To: <20220603115049.1908792-1-f.gruenbichler@proxmox.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-SPAM-LEVEL: Spam detection results:  0
 AWL 0.007 Adjusted score from AWL reputation of From: address
 BAYES_00                 -1.9 Bayes spam probability is 0 to 1%
 KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
 SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
 SPF_PASS               -0.001 SPF: sender matches SPF record
 T_SCC_BODY_TEXT_LINE    -0.01 -
 URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
 http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
 information. [perm-test8.pl, rpcenvironment.pm]
Subject: [pve-devel] applied series: [PATCH access-control 0/3] fix two
 propagation related bugs
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, 
 <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, 
 <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Fri, 03 Jun 2022 12:03:56 -0000

Am 03/06/2022 um 13:50 schrieb Fabian Gr=C3=BCnbichler:
> these patches fix two related bugs:
> - the propagation flag used for priv dumping was set randomly if two
>   roles with a common priv exist on a path, one with and one without
>   propagation
> - user/token priv intersection only took user privs into account that
>   had propagation set
>=20
> the first can affect the second one negatively (if the first bug causes=

> the propagation flag to be dropped, the second one will drop the priv
> from the merged set of privileges for priv-separated tokens).
>=20
> in both cases there is no possibility to elevate privileges:
> - bug #1 sometimes marks privs as non-propagated that are, but only for=

>   display, not for checking purposes
> - bug #2 causes a token to have less privileges than it should, not mor=
e
>=20
> Fabian Gr=C3=BCnbichler (3):
>   permissions: properly merge propagation flag
>   permissions: fix token/user priv intersection
>   permissions: add some more comments
>=20
>  src/PVE/RPCEnvironment.pm | 44 +++++++++++++++++++++++++++++++++++----=

>  src/test/perm-test8.pl    |  2 +-
>  src/test/test8.cfg        |  2 ++
>  3 files changed, 43 insertions(+), 5 deletions(-)
>=20


applied series, thanks!