From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 9B94B1FF137 for ; Tue, 17 Feb 2026 12:12:04 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 263C9341E0; Tue, 17 Feb 2026 12:12:51 +0100 (CET) From: Samuel Rufinatscha To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-datacenter-manager v5 1/3] pdm-config: implement token.shadow generation Date: Tue, 17 Feb 2026 12:12:26 +0100 Message-ID: <20260217111229.78661-10-s.rufinatscha@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260217111229.78661-1-s.rufinatscha@proxmox.com> References: <20260217111229.78661-1-s.rufinatscha@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1771326748522 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.251 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 3G2BNAMFXDOLIWBQIPKHZWN6BMX5A3MI X-Message-ID-Hash: 3G2BNAMFXDOLIWBQIPKHZWN6BMX5A3MI X-MailFrom: s.rufinatscha@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: PDM depends on the shared proxmox/proxmox-access-control crate for token.shadow handling which expects the product to provide a cross-process invalidation signal so it can cache/invalidate token.shadow secrets. This patch wires AccessControlConfig to ConfigVersionCache for token.shadow invalidation and switches server/CLI/UI init to use pdm-config’s AccessControlConfig. Safety: the shmem mapping is fixed to 4096 bytes via the #[repr(C)] union padding, and the new atomic is appended to the end of the #[repr(C)] inner struct, so all existing field offsets stay unchanged. Old processes keep accessing the same bytes and new processes consume previously reserved padding. Signed-off-by: Samuel Rufinatscha --- Changes from v4 to v5: * Rebased * Added safety note to commit message Changes from v3 to v4: * pdm-api-types: replace AccessControlConfig with AccessControlPermissions and implement init::AccessControlPermissions there * pdm-config: add new AccessControlConfig implementing init::AccessControlConfig * UI: init uses a local UiAccessControlConfig for init_access_config() * Adjusted commit message cli/admin/src/main.rs | 2 +- lib/pdm-api-types/src/acl.rs | 4 ++-- lib/pdm-config/Cargo.toml | 1 + lib/pdm-config/src/access_control.rs | 20 ++++++++++++++++++++ lib/pdm-config/src/config_version_cache.rs | 18 ++++++++++++++++++ lib/pdm-config/src/lib.rs | 2 ++ server/src/acl.rs | 3 +-- ui/src/main.rs | 10 +++++++++- 8 files changed, 54 insertions(+), 6 deletions(-) create mode 100644 lib/pdm-config/src/access_control.rs diff --git a/cli/admin/src/main.rs b/cli/admin/src/main.rs index f698fa2..916c633 100644 --- a/cli/admin/src/main.rs +++ b/cli/admin/src/main.rs @@ -19,7 +19,7 @@ fn main() { proxmox_product_config::init(api_user, priv_user); proxmox_access_control::init::init( - &pdm_api_types::AccessControlConfig, + &pdm_config::AccessControlConfig, pdm_buildcfg::configdir!("/access"), ) .expect("failed to setup access control config"); diff --git a/lib/pdm-api-types/src/acl.rs b/lib/pdm-api-types/src/acl.rs index 405982a..7c405a7 100644 --- a/lib/pdm-api-types/src/acl.rs +++ b/lib/pdm-api-types/src/acl.rs @@ -187,9 +187,9 @@ pub struct AclListItem { pub roleid: String, } -pub struct AccessControlConfig; +pub struct AccessControlPermissions; -impl proxmox_access_control::init::AccessControlConfig for AccessControlConfig { +impl proxmox_access_control::init::AccessControlPermissions for AccessControlPermissions { fn privileges(&self) -> &HashMap<&str, u64> { static PRIVS: LazyLock> = LazyLock::new(|| PRIVILEGES.iter().copied().collect()); diff --git a/lib/pdm-config/Cargo.toml b/lib/pdm-config/Cargo.toml index d39c2ad..19781d2 100644 --- a/lib/pdm-config/Cargo.toml +++ b/lib/pdm-config/Cargo.toml @@ -13,6 +13,7 @@ once_cell.workspace = true openssl.workspace = true serde.workspace = true +proxmox-access-control.workspace = true proxmox-config-digest = { workspace = true, features = [ "openssl" ] } proxmox-http = { workspace = true, features = [ "http-helpers" ] } proxmox-ldap = { workspace = true, features = [ "types" ]} diff --git a/lib/pdm-config/src/access_control.rs b/lib/pdm-config/src/access_control.rs new file mode 100644 index 0000000..389b3f4 --- /dev/null +++ b/lib/pdm-config/src/access_control.rs @@ -0,0 +1,20 @@ +use anyhow::Error; + +pub struct AccessControlConfig; + +impl proxmox_access_control::init::AccessControlConfig for AccessControlConfig { + fn permissions(&self) -> &dyn proxmox_access_control::init::AccessControlPermissions { + &pdm_api_types::AccessControlPermissions + } + + fn token_shadow_cache_generation(&self) -> Option { + crate::ConfigVersionCache::new() + .ok() + .map(|c| c.token_shadow_generation()) + } + + fn increment_token_shadow_cache_generation(&self) -> Result { + let c = crate::ConfigVersionCache::new()?; + Ok(c.increase_token_shadow_generation()) + } +} diff --git a/lib/pdm-config/src/config_version_cache.rs b/lib/pdm-config/src/config_version_cache.rs index 36a6a77..933140c 100644 --- a/lib/pdm-config/src/config_version_cache.rs +++ b/lib/pdm-config/src/config_version_cache.rs @@ -27,6 +27,8 @@ struct ConfigVersionCacheDataInner { traffic_control_generation: AtomicUsize, // Tracks updates to the remote/hostname/nodename mapping cache. remote_mapping_cache: AtomicUsize, + // Token shadow (token.shadow) generation/version. + token_shadow_generation: AtomicUsize, // Add further atomics here } @@ -172,4 +174,20 @@ impl ConfigVersionCache { .fetch_add(1, Ordering::Relaxed) + 1 } + + /// Returns the token shadow generation number. + pub fn token_shadow_generation(&self) -> usize { + self.shmem + .data() + .token_shadow_generation + .load(Ordering::Acquire) + } + + /// Increase the token shadow generation number. + pub fn increase_token_shadow_generation(&self) -> usize { + self.shmem + .data() + .token_shadow_generation + .fetch_add(1, Ordering::AcqRel) + } } diff --git a/lib/pdm-config/src/lib.rs b/lib/pdm-config/src/lib.rs index 4c49054..614f7ae 100644 --- a/lib/pdm-config/src/lib.rs +++ b/lib/pdm-config/src/lib.rs @@ -9,6 +9,8 @@ pub mod remotes; pub mod setup; pub mod views; +mod access_control; +pub use access_control::AccessControlConfig; mod config_version_cache; pub use config_version_cache::ConfigVersionCache; diff --git a/server/src/acl.rs b/server/src/acl.rs index f421814..e6e007b 100644 --- a/server/src/acl.rs +++ b/server/src/acl.rs @@ -1,6 +1,5 @@ pub(crate) fn init() { - static ACCESS_CONTROL_CONFIG: pdm_api_types::AccessControlConfig = - pdm_api_types::AccessControlConfig; + static ACCESS_CONTROL_CONFIG: pdm_config::AccessControlConfig = pdm_config::AccessControlConfig; proxmox_access_control::init::init(&ACCESS_CONTROL_CONFIG, pdm_buildcfg::configdir!("/access")) .expect("failed to setup access control config"); diff --git a/ui/src/main.rs b/ui/src/main.rs index 2bd900e..9f87505 100644 --- a/ui/src/main.rs +++ b/ui/src/main.rs @@ -390,10 +390,18 @@ fn main() { pwt::state::set_available_languages(proxmox_yew_comp::available_language_list()); if let Err(e) = - proxmox_access_control::init::init_access_config(&pdm_api_types::AccessControlConfig) + proxmox_access_control::init::init_access_config(&UiAccessControlConfig) { log::error!("could not initialize access control config - {e:#}"); } yew::Renderer::::new().render(); } + +struct UiAccessControlConfig; + +impl proxmox_access_control::init::AccessControlConfig for UiAccessControlConfig { + fn permissions(&self) -> &dyn proxmox_access_control::init::AccessControlPermissions { + &pdm_api_types::AccessControlPermissions + } +} -- 2.47.3