[PATCH proxmox-backup] fix #7911: api: report: mark endpoint as protected

[PATCH proxmox-backup] fix #7911: api: report: mark endpoint as protected

[Erik Fastermann]

The report was generated by proxmox-backup-proxy, which runs as the
unprivileged 'backup' user, so commands needing root only partly
worked. ethtool printed "netlink error: Operation not permitted" to
stderr, which ended up in the report. dmidecode and proxmox-boot-tool
failed completely.

Forward the request to the privileged API daemon instead, like PVE,
PMG and PDM already do. Users with Sys.Audit thus see slightly more
host details, which the other products already accept.

Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
---
 src/api2/node/report.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/api2/node/report.rs b/src/api2/node/report.rs
index f71f5b25f..5d728a137 100644
--- a/src/api2/node/report.rs
+++ b/src/api2/node/report.rs
@@ -9,6 +9,7 @@ use pbs_api_types::{NODE_SCHEMA, PRIV_SYS_AUDIT};
 use crate::server::generate_report;
 
 #[api(
+    protected: true,
     input: {
         properties: {
             node: {
-- 
2.47.3

Re: [PATCH proxmox-backup] fix #7911: api: report: mark endpoint as protected

[Christian Ebner]

On 8/11/26 11:36 AM, Erik Fastermann wrote:
> The report was generated by proxmox-backup-proxy, which runs as the
> unprivileged 'backup' user, so commands needing root only partly
> worked. ethtool printed "netlink error: Operation not permitted" to
> stderr, which ended up in the report. dmidecode and proxmox-boot-tool
> failed completely.
> 
> Forward the request to the privileged API daemon instead, like PVE,
> PMG and PDM already do. Users with Sys.Audit thus see slightly more
> host details, which the other products already accept.

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7911

> Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>

Reviewed-by: Christian Ebner <c.ebner@proxmox.com>
Tested-by: Christian Ebner <c.ebner@proxmox.com>

One question which came to mind during review is if we should maybe also 
add stricter type checks on the allowed parameters returned by 
dynamic_commands()?

We do allow arbitrary strings to be returned there. While the current 
use-case is protected by proxmox-network-api config parsing, I think it 
would make sense to restrict this to avoid potential future miss-use and 
potential code execution by injection (after all one runs as privileged 
user now).

Maybe we could add an enum with allowed command -> args pairs? The args 
assured to be type checked?

> ---
>   src/api2/node/report.rs | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/src/api2/node/report.rs b/src/api2/node/report.rs
> index f71f5b25f..5d728a137 100644
> --- a/src/api2/node/report.rs
> +++ b/src/api2/node/report.rs
> @@ -9,6 +9,7 @@ use pbs_api_types::{NODE_SCHEMA, PRIV_SYS_AUDIT};
>   use crate::server::generate_report;
>   
>   #[api(
> +    protected: true,
>       input: {
>           properties: {
>               node: {