From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id D989D69CC0 for ; Fri, 12 Mar 2021 11:29:12 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id D07C931876 for ; Fri, 12 Mar 2021 11:28:42 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 3E49C3186C for ; Fri, 12 Mar 2021 11:28:42 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 0BBFF420A8 for ; Fri, 12 Mar 2021 11:28:42 +0100 (CET) From: Dominik Csapak To: pbs-devel@lists.proxmox.com Date: Fri, 12 Mar 2021 11:28:41 +0100 Message-Id: <20210312102841.11712-2-d.csapak@proxmox.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20210312102841.11712-1-d.csapak@proxmox.com> References: <20210312102841.11712-1-d.csapak@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.189 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [restore.rs, proxmox-tape.rs] Subject: [pbs-devel] [PATCH proxmox-backup 2/2] ui: tape/Restore: let the user choose an owner X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Mar 2021 10:29:12 -0000 so that the tape backup can be restored as any user, given the current logged in user has the correct permission. Signed-off-by: Dominik Csapak --- src/api2/tape/restore.rs | 24 +++++++++++++++++++++++- src/bin/proxmox-tape.rs | 5 +++++ www/tape/window/TapeRestore.js | 10 ++++++++++ 3 files changed, 38 insertions(+), 1 deletion(-) diff --git a/src/api2/tape/restore.rs b/src/api2/tape/restore.rs index 504bc296..85b14f21 100644 --- a/src/api2/tape/restore.rs +++ b/src/api2/tape/restore.rs @@ -40,6 +40,7 @@ use crate::{ cached_user_info::CachedUserInfo, acl::{ PRIV_DATASTORE_BACKUP, + PRIV_DATASTORE_MODIFY, PRIV_TAPE_READ, }, }, @@ -105,6 +106,10 @@ pub const ROUTER: Router = Router::new() type: Userid, optional: true, }, + owner: { + type: Authid, + optional: true, + }, }, }, returns: { @@ -123,6 +128,7 @@ pub fn restore( drive: String, media_set: String, notify_user: Option, + owner: Option, rpcenv: &mut dyn RpcEnvironment, ) -> Result { @@ -134,6 +140,18 @@ pub fn restore( bail!("no permissions on /datastore/{}", store); } + if let Some(ref owner) = owner { + let correct_owner = owner == &auth_id + || (owner.is_token() + && !auth_id.is_token() + && owner.user() == auth_id.user()); + + // same permission as changing ownership after syncing + if !correct_owner && privs & PRIV_DATASTORE_MODIFY == 0 { + bail!("no permission to restore as '{}'", owner); + } + } + let privs = user_info.lookup_privs(&auth_id, &["tape", "drive", &drive]); if (privs & PRIV_TAPE_READ) == 0 { bail!("no permissions on /tape/drive/{}", drive); @@ -222,6 +240,7 @@ pub fn restore( &datastore, &auth_id, ¬ify_user, + &owner, )?; } @@ -252,6 +271,7 @@ pub fn request_and_restore_media( datastore: &DataStore, authid: &Authid, notify_user: &Option, + owner: &Option, ) -> Result<(), Error> { let media_set_uuid = match media_id.media_set_label { @@ -284,7 +304,9 @@ pub fn request_and_restore_media( } } - restore_media(worker, &mut drive, &info, Some((datastore, authid)), false) + let restore_owner = owner.as_ref().unwrap_or(authid); + + restore_media(worker, &mut drive, &info, Some((datastore, restore_owner)), false) } /// Restore complete media content and catalog diff --git a/src/bin/proxmox-tape.rs b/src/bin/proxmox-tape.rs index ad39ec82..69dd7a8d 100644 --- a/src/bin/proxmox-tape.rs +++ b/src/bin/proxmox-tape.rs @@ -27,6 +27,7 @@ use proxmox_backup::{ api2::{ self, types::{ + Authid, DATASTORE_SCHEMA, DRIVE_NAME_SCHEMA, MEDIA_LABEL_SCHEMA, @@ -868,6 +869,10 @@ async fn backup(mut param: Value) -> Result<(), Error> { type: Userid, optional: true, }, + owner: { + type: Authid, + optional: true, + }, "output-format": { schema: OUTPUT_FORMAT, optional: true, diff --git a/www/tape/window/TapeRestore.js b/www/tape/window/TapeRestore.js index abf3cf68..6b356bda 100644 --- a/www/tape/window/TapeRestore.js +++ b/www/tape/window/TapeRestore.js @@ -51,5 +51,15 @@ Ext.define('PBS.TapeManagement.TapeRestoreWindow', { skipEmptyText: true, renderer: Ext.String.htmlEncode, }, + { + xtype: 'pbsUserSelector', + name: 'owner', + fieldLabel: gettext('Owner'), + emptyText: gettext('Current User'), + value: null, + allowBlank: true, + skipEmptyText: true, + renderer: Ext.String.htmlEncode, + }, ], }); -- 2.20.1