Re: [PATCH proxmox-backup 27/28] api: admin: allow to update snapshot retention for root user

[Robert Obkircher <r.obkircher@proxmox.com>]

> Only root user should be able to ever modify the retention setting
> set by the sync/backup api.
> 
> Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
>
> diff --git a/src/api2/admin/datastore.rs b/src/api2/admin/datastore.rs
> index bb829cd3f..244320989 100644
> --- a/src/api2/admin/datastore.rs
> +++ b/src/api2/admin/datastore.rs
> @@ -45,7 +45,7 @@ use pbs_api_types::{
>      MaintenanceMode, MaintenanceType, NS_MAX_DEPTH_SCHEMA, Operation, PRIV_DATASTORE_AUDIT,
>      PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE, PRIV_DATASTORE_READ,
>      PRIV_DATASTORE_VERIFY, PRIV_SYS_MODIFY, PruneJobOptions, SnapshotListItem, SyncJobConfig, UPID,
> -    UPID_SCHEMA, VERIFICATION_OUTDATED_AFTER_SCHEMA, VERIFY_JOB_READ_THREADS_SCHEMA,
> +    UPID_SCHEMA, Userid, VERIFICATION_OUTDATED_AFTER_SCHEMA, VERIFY_JOB_READ_THREADS_SCHEMA,
>      VERIFY_JOB_VERIFY_THREADS_SCHEMA, print_ns_and_snapshot, print_store_and_ns,
>  };
>  use pbs_client::pxar::{create_tar, create_zip};
> @@ -2319,6 +2319,56 @@ pub async fn set_protection(
>      .await?
>  }
>  
> +#[api(
> +    input: {
> +        properties: {
> +            store: { schema: DATASTORE_SCHEMA },
> +            ns: {
> +                type: BackupNamespace,
> +                optional: true,
> +            },
> +            backup_dir: {
> +                type: pbs_api_types::BackupDir,
> +                flatten: true,
> +            },
> +            "retain-until": {
> +                type: Number,
> +                description: "Set retention timestamp (clears retention if not given)",
> +                optional: true,
> +            },
> +        },
> +    },
> +    access: {
> +        permission: &Permission::Anybody,
> +        description: "Only root@pam is allowed to modify retentions",
Could this be Permission::Superuser?

-- 
Robert Obkircher <r.obkircher@proxmox.com>