From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 11B15696E0 for ; Tue, 2 Mar 2021 16:31:22 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 081AE2ED38 for ; Tue, 2 Mar 2021 16:31:22 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id E28542ED2D for ; Tue, 2 Mar 2021 16:31:20 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id AC3B44581E for ; Tue, 2 Mar 2021 16:31:20 +0100 (CET) From: Dominik Csapak To: pbs-devel@lists.proxmox.com Date: Tue, 2 Mar 2021 16:31:20 +0100 Message-Id: <20210302153120.31213-1-d.csapak@proxmox.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.201 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [rest.rs] Subject: [pbs-devel] [RFC PATCH proxmox-backup] server/rest: disallow non-protected api calls in privileged environment X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Mar 2021 15:31:22 -0000 to prevent potential abuse of non-protected api calls as root Signed-off-by: Dominik Csapak --- this is a rather theoretical security improvement, i am not sure if we want this? it would only guard against an unprotected api call that somehow allows code execution. this could then be abused to connect to the daemon and reabuse the same api call, but with root permissions also if we want this, maybe this would be good to have in pve too? src/server/rest.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/server/rest.rs b/src/server/rest.rs index 9bf494fd..6b170b7f 100644 --- a/src/server/rest.rs +++ b/src/server/rest.rs @@ -750,6 +750,9 @@ async fn handle_request( let result = if api_method.protected && env_type == RpcEnvironmentType::PUBLIC { proxy_protected_request(api_method, parts, body, peer).await + } else if !api_method.protected && env_type == RpcEnvironmentType::PRIVILEGED { + let err = http_err!(FORBIDDEN, "invalid server request"); + return Ok((formatter.format_error)(err)); } else { handle_api_request(rpcenv, api_method, formatter, parts, body, uri_param).await }; -- 2.20.1