From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 2486162BF7 for ; Fri, 18 Sep 2020 11:45:19 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 1031A14B52 for ; Fri, 18 Sep 2020 11:45:19 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id BA8DA14B46 for ; Fri, 18 Sep 2020 11:45:17 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 5550F45415 for ; Fri, 18 Sep 2020 11:45:17 +0200 (CEST) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pbs-devel@lists.proxmox.com Date: Fri, 18 Sep 2020 11:45:11 +0200 Message-Id: <20200918094511.1571558-1-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.029 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [store.name, datastore.rs] Subject: [pbs-devel] [PATCH proxmox-backup] fix #3014: allow DataStoreAdmins to list DS config X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2020 09:45:19 -0000 filtered by those they are privileged enough to read individually. this allows such users to configure prune/GC schedules via the GUI (the API already allowed it previously). permission-wise, a user with this privilege can already: - list all stores they have access to (returns just name/comment) - read the config of each store they have access to individually (returns full config of that datastore + digest of whole config) but combines them to - read configs of all datastores they have access to (returns full config of those datastores + digest of whole config) user that have AUDIT on just /datastore without propagate can now no longer read all configurations (but this could be added it back, it just seems to make little sense to me). Signed-off-by: Fabian Grünbichler --- src/api2/config/datastore.rs | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/api2/config/datastore.rs b/src/api2/config/datastore.rs index 1ee303f8..0f4021d6 100644 --- a/src/api2/config/datastore.rs +++ b/src/api2/config/datastore.rs @@ -9,6 +9,7 @@ use proxmox::tools::fs::open_file_locked; use crate::api2::types::*; use crate::backup::*; +use crate::config::cached_user_info::CachedUserInfo; use crate::config::datastore::{self, DataStoreConfig, DIR_NAME_SCHEMA}; use crate::config::acl::{PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_MODIFY}; @@ -22,7 +23,7 @@ use crate::config::acl::{PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_MODIFY}; items: { type: datastore::DataStoreConfig }, }, access: { - permission: &Permission::Privilege(&["datastore"], PRIV_DATASTORE_AUDIT, false), + permission: &Permission::Anybody, }, )] /// List all datastores @@ -33,11 +34,18 @@ pub fn list_datastores( let (config, digest) = datastore::config()?; - let list = config.convert_to_typed_array("datastore")?; + let userid: Userid = rpcenv.get_user().unwrap().parse()?; + let user_info = CachedUserInfo::new()?; rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into(); - Ok(list) + let list:Vec = config.convert_to_typed_array("datastore")?; + let filter_by_privs = |store: &DataStoreConfig| { + let user_privs = user_info.lookup_privs(&userid, &["datastore", &store.name]); + (user_privs & PRIV_DATASTORE_AUDIT) != 0 + }; + + Ok(list.into_iter().filter(filter_by_privs).collect()) } -- 2.20.1