Re: [PATCH proxmox-backup] fix #7911: api: report: mark endpoint as protected

[Christian Ebner <c.ebner@proxmox.com>]

On 8/11/26 11:36 AM, Erik Fastermann wrote:
> The report was generated by proxmox-backup-proxy, which runs as the
> unprivileged 'backup' user, so commands needing root only partly
> worked. ethtool printed "netlink error: Operation not permitted" to
> stderr, which ended up in the report. dmidecode and proxmox-boot-tool
> failed completely.
> 
> Forward the request to the privileged API daemon instead, like PVE,
> PMG and PDM already do. Users with Sys.Audit thus see slightly more
> host details, which the other products already accept.

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7911

> Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>

Reviewed-by: Christian Ebner <c.ebner@proxmox.com>
Tested-by: Christian Ebner <c.ebner@proxmox.com>

One question which came to mind during review is if we should maybe also 
add stricter type checks on the allowed parameters returned by 
dynamic_commands()?

We do allow arbitrary strings to be returned there. While the current 
use-case is protected by proxmox-network-api config parsing, I think it 
would make sense to restrict this to avoid potential future miss-use and 
potential code execution by injection (after all one runs as privileged 
user now).

Maybe we could add an enum with allowed command -> args pairs? The args 
assured to be type checked?

> ---
>   src/api2/node/report.rs | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/src/api2/node/report.rs b/src/api2/node/report.rs
> index f71f5b25f..5d728a137 100644
> --- a/src/api2/node/report.rs
> +++ b/src/api2/node/report.rs
> @@ -9,6 +9,7 @@ use pbs_api_types::{NODE_SCHEMA, PRIV_SYS_AUDIT};
>   use crate::server::generate_report;
>   
>   #[api(
> +    protected: true,
>       input: {
>           properties: {
>               node: {