From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 0C732608EC for ; Fri, 9 Oct 2020 11:21:12 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 00BA8154D5 for ; Fri, 9 Oct 2020 11:21:12 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id B9695154C7 for ; Fri, 9 Oct 2020 11:21:10 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 836FB45C9C for ; Fri, 9 Oct 2020 11:21:10 +0200 (CEST) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pbs-devel@lists.proxmox.com Date: Fri, 9 Oct 2020 11:21:02 +0200 Message-Id: <20201009092102.1959849-2-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20201009092102.1959849-1-f.gruenbichler@proxmox.com> References: <20201009092102.1959849-1-f.gruenbichler@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.034 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [reader.rs] Subject: [pbs-devel] [PATCH proxmox-backup 2/2] reader: actually allow users to downlod their own backups X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Oct 2020 09:21:12 -0000 via HTTP2/backup reader protocol. they already could do so via the plain HTTP download-file/.. API calls that the GUI uses, but the reader environment required READ permission on the whole datastore instead of just BACKUP on the backup group itself. Signed-off-by: Fabian Grünbichler --- src/api2/reader.rs | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/api2/reader.rs b/src/api2/reader.rs index 5bdd81b7..4c870eda 100644 --- a/src/api2/reader.rs +++ b/src/api2/reader.rs @@ -14,7 +14,7 @@ use crate::api2::types::*; use crate::backup::*; use crate::server::{WorkerTask, H2Service}; use crate::tools; -use crate::config::acl::PRIV_DATASTORE_READ; +use crate::config::acl::{PRIV_DATASTORE_READ, PRIV_DATASTORE_BACKUP}; use crate::config::cached_user_info::CachedUserInfo; use crate::api2::helpers; @@ -58,7 +58,15 @@ fn upgrade_to_backup_reader_protocol( let store = tools::required_string_param(¶m, "store")?.to_owned(); let user_info = CachedUserInfo::new()?; - user_info.check_privs(&userid, &["datastore", &store], PRIV_DATASTORE_READ, false)?; + let privs = user_info.lookup_privs(&userid, &["datastore", &store]); + + let priv_read = privs & PRIV_DATASTORE_READ != 0; + let priv_backup = privs & PRIV_DATASTORE_BACKUP != 0; + + // priv_backup needs owner check further down below! + if !priv_read && !priv_backup { + bail!("no permissions on /datastore/{}", store); + } let datastore = DataStore::lookup_datastore(&store)?; @@ -83,6 +91,13 @@ fn upgrade_to_backup_reader_protocol( let env_type = rpcenv.env_type(); let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?; + if !priv_read { + let owner = datastore.get_owner(backup_dir.group())?; + if owner != userid { + bail!("backup owner check failed!"); + } + } + let path = datastore.base_path(); //let files = BackupInfo::list_files(&path, &backup_dir)?; -- 2.20.1