[PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[Fabian Grünbichler]

the wrong path was copied over from the node shell, and since there is no
"node" parameter here, calls as non-root will fail with 403..

Fixes: 525c8c49 "server: add termproxy and vncwebsocket calls for qemu guests"

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
403 if the API schema is actually invalid might be something to catch
lower in the stack as well?

 server/src/api/pve/lxc.rs  | 4 ++--
 server/src/api/pve/qemu.rs | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
index 6183f62d..ca32eb84 100644
--- a/server/src/api/pve/lxc.rs
+++ b/server/src/api/pve/lxc.rs
@@ -807,9 +807,9 @@ pub const API_METHOD_LXC_WEBSOCKET: ApiMethod = ApiMethod::new(
     ),
 )
 .access(
-    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
+    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
     &Permission::Privilege(
-        &["resource", "{remote}", "node", "{node}"],
+        &["resource", "{remote}", "guest", "{vmid}"],
         PRIV_SYS_CONSOLE,
         false,
     ),
diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
index 65de6389..5d01e69e 100644
--- a/server/src/api/pve/qemu.rs
+++ b/server/src/api/pve/qemu.rs
@@ -895,9 +895,9 @@ pub const API_METHOD_QEMU_WEBSOCKET: ApiMethod = ApiMethod::new(
     ),
 )
 .access(
-    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
+    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
     &Permission::Privilege(
-        &["resource", "{remote}", "node", "{node}"],
+        &["resource", "{remote}", "guest", "{vmid}"],
         PRIV_SYS_CONSOLE,
         false,
     ),
-- 
2.47.3

Re: [PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[Dominik Csapak]

On 7/8/26 12:40 PM, Fabian Grünbichler wrote:
> the wrong path was copied over from the node shell, and since there is no
> "node" parameter here, calls as non-root will fail with 403..
> 
> Fixes: 525c8c49 "server: add termproxy and vncwebsocket calls for qemu guests"
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
> 403 if the API schema is actually invalid might be something to catch
> lower in the stack as well?

i guess the substitution fails during privilege check in proxmox-router
and that triggers a 403 higher up in the stack?

since that must be const, maybe there can be a compile time check that
the parameters must exist here?

> 
>   server/src/api/pve/lxc.rs  | 4 ++--
>   server/src/api/pve/qemu.rs | 4 ++--
>   2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
> index 6183f62d..ca32eb84 100644
> --- a/server/src/api/pve/lxc.rs
> +++ b/server/src/api/pve/lxc.rs
> @@ -807,9 +807,9 @@ pub const API_METHOD_LXC_WEBSOCKET: ApiMethod = ApiMethod::new(
>       ),
>   )
>   .access(
> -    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
> +    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
>       &Permission::Privilege(
> -        &["resource", "{remote}", "node", "{node}"],
> +        &["resource", "{remote}", "guest", "{vmid}"],
>           PRIV_SYS_CONSOLE,
>           false,
>       ),
> diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
> index 65de6389..5d01e69e 100644
> --- a/server/src/api/pve/qemu.rs
> +++ b/server/src/api/pve/qemu.rs
> @@ -895,9 +895,9 @@ pub const API_METHOD_QEMU_WEBSOCKET: ApiMethod = ApiMethod::new(
>       ),
>   )
>   .access(
> -    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
> +    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
>       &Permission::Privilege(
> -        &["resource", "{remote}", "node", "{node}"],
> +        &["resource", "{remote}", "guest", "{vmid}"],
>           PRIV_SYS_CONSOLE,
>           false,
>       ),

Re: [PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[Dominik Csapak]

On 7/8/26 1:24 PM, Dominik Csapak wrote:
> 
> 
> On 7/8/26 12:40 PM, Fabian Grünbichler wrote:
>> the wrong path was copied over from the node shell, and since there is no
>> "node" parameter here, calls as non-root will fail with 403..
>>
>> Fixes: 525c8c49 "server: add termproxy and vncwebsocket calls for qemu 
>> guests"
>>
>> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
>> ---
>> 403 if the API schema is actually invalid might be something to catch
>> lower in the stack as well?
> 
> i guess the substitution fails during privilege check in proxmox-router
> and that triggers a 403 higher up in the stack?
> 
> since that must be const, maybe there can be a compile time check that
> the parameters must exist here?
> 

had a short stab at this and this does indeed work:
https://lore.proxmox.com/pdm-devel/20260708133630.1807997-1-d.csapak@proxmox.com/T/#t

it also found a third place where we used a non existant parameter
(2/2 in that series)

>>
>>   server/src/api/pve/lxc.rs  | 4 ++--
>>   server/src/api/pve/qemu.rs | 4 ++--
>>   2 files changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
>> index 6183f62d..ca32eb84 100644
>> --- a/server/src/api/pve/lxc.rs
>> +++ b/server/src/api/pve/lxc.rs
>> @@ -807,9 +807,9 @@ pub const API_METHOD_LXC_WEBSOCKET: ApiMethod = 
>> ApiMethod::new(
>>       ),
>>   )
>>   .access(
>> -    Some("The user needs Sys.Console on /resource/{remote}/node/ 
>> {node}."),
>> +    Some("The user needs Sys.Console on /resource/{remote}/guest/ 
>> {vmid}."),
>>       &Permission::Privilege(
>> -        &["resource", "{remote}", "node", "{node}"],
>> +        &["resource", "{remote}", "guest", "{vmid}"],
>>           PRIV_SYS_CONSOLE,
>>           false,
>>       ),
>> diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
>> index 65de6389..5d01e69e 100644
>> --- a/server/src/api/pve/qemu.rs
>> +++ b/server/src/api/pve/qemu.rs
>> @@ -895,9 +895,9 @@ pub const API_METHOD_QEMU_WEBSOCKET: ApiMethod = 
>> ApiMethod::new(
>>       ),
>>   )
>>   .access(
>> -    Some("The user needs Sys.Console on /resource/{remote}/node/ 
>> {node}."),
>> +    Some("The user needs Sys.Console on /resource/{remote}/guest/ 
>> {vmid}."),
>>       &Permission::Privilege(
>> -        &["resource", "{remote}", "node", "{node}"],
>> +        &["resource", "{remote}", "guest", "{vmid}"],
>>           PRIV_SYS_CONSOLE,
>>           false,
>>       ),
> 
> 
> 
> 
>