[PATCH proxmox-backup v2 19/43] api: allow namespace creation on append permissions

[Christian Ebner <c.ebner@proxmox.com>]

Only require full modify permissions for moves and namespace
destruction, allow namespace creation also with append permissions.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/api2/admin/namespace.rs |  8 ++++----
 src/api2/tape/restore.rs    |  6 +++---
 src/backup/hierarchy.rs     | 12 +++++++++++-
 src/server/pull.rs          | 10 +++++-----
 4 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/src/api2/admin/namespace.rs b/src/api2/admin/namespace.rs
index 19e1e8cd0..f874f8129 100644
--- a/src/api2/admin/namespace.rs
+++ b/src/api2/admin/namespace.rs
@@ -56,7 +56,7 @@ pub fn create_namespace(
     let mut ns = parent.clone();
     ns.push(name.clone())?;
 
-    check_ns_modification_privs(&store, &ns, &auth_id)?;
+    check_ns_modification_privs(&store, &ns, &auth_id, false)?;
 
     let lookup = crate::tools::lookup_with(&store, Operation::Write);
     let datastore = DataStore::lookup_datastore(lookup)?;
@@ -166,7 +166,7 @@ pub fn delete_namespace(
 ) -> Result<BackupGroupDeleteStats, Error> {
     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 
-    check_ns_modification_privs(&store, &ns, &auth_id)?;
+    check_ns_modification_privs(&store, &ns, &auth_id, true)?;
 
     let lookup = crate::tools::lookup_with(&store, Operation::Write);
     let datastore = DataStore::lookup_datastore(lookup)?;
@@ -247,8 +247,8 @@ pub fn move_namespace(
 ) -> Result<Value, Error> {
     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 
-    check_ns_modification_privs(&store, &ns, &auth_id)?;
-    check_ns_modification_privs(&store, &target_ns, &auth_id)?;
+    check_ns_modification_privs(&store, &ns, &auth_id, true)?;
+    check_ns_modification_privs(&store, &target_ns, &auth_id, true)?;
 
     let datastore =
         DataStore::lookup_datastore(crate::tools::lookup_with(&store, Operation::Write))?;
diff --git a/src/api2/tape/restore.rs b/src/api2/tape/restore.rs
index 6544aa726..ffa63b104 100644
--- a/src/api2/tape/restore.rs
+++ b/src/api2/tape/restore.rs
@@ -254,9 +254,9 @@ fn check_and_create_namespaces(
         for comp in ns.components() {
             tmp_ns.push(comp.to_string())?;
             if !store.namespace_exists(&tmp_ns) {
-                check_ns_modification_privs(store.name(), &tmp_ns, auth_id).map_err(|_err| {
-                    format_err!("no permission to create namespace '{}'", tmp_ns)
-                })?;
+                check_ns_modification_privs(store.name(), &tmp_ns, auth_id, false).map_err(
+                    |_err| format_err!("no permission to create namespace '{}'", tmp_ns),
+                )?;
 
                 store.create_namespace(&tmp_ns.parent(), comp.to_string())?;
             }
diff --git a/src/backup/hierarchy.rs b/src/backup/hierarchy.rs
index d81dc3565..5cc8fd778 100644
--- a/src/backup/hierarchy.rs
+++ b/src/backup/hierarchy.rs
@@ -20,10 +20,14 @@ pub fn check_ns_privs(
 }
 
 /// Asserts that `privs` for creating/destroying namespace in datastore are fulfilled.
+///
+/// If `needs_full_modify_priv` is not set, `Datastore.Append` is sufficient which must
+/// allow namespace creation only, never deletion.
 pub fn check_ns_modification_privs(
     store: &str,
     ns: &BackupNamespace,
     auth_id: &Authid,
+    needs_full_modify_priv: bool,
 ) -> Result<(), Error> {
     // we could allow it as easy purge-whole datastore, but lets be more restrictive for now
     if ns.is_root() {
@@ -33,7 +37,13 @@ pub fn check_ns_modification_privs(
 
     let parent = ns.parent();
 
-    check_ns_privs(store, &parent, auth_id, PRIV_DATASTORE_MODIFY)
+    let required_privs = if needs_full_modify_priv {
+        PRIV_DATASTORE_MODIFY
+    } else {
+        PRIV_DATASTORE_APPEND | PRIV_DATASTORE_MODIFY
+    };
+
+    check_ns_privs(store, &parent, auth_id, required_privs)
 }
 
 /// Asserts that either either `full_access_privs` or `partial_access_privs` are fulfilled on
diff --git a/src/server/pull.rs b/src/server/pull.rs
index 501c05a1b..b7b28c3d5 100644
--- a/src/server/pull.rs
+++ b/src/server/pull.rs
@@ -22,8 +22,8 @@ use tokio::io::AsyncWriteExt;
 use pbs_api_types::{
     ArchiveType, Authid, BackupDir, BackupGroup, BackupNamespace, CLIENT_LOG_BLOB_NAME, CryptMode,
     Fingerprint, GroupFilter, MANIFEST_BLOB_NAME, MAX_NAMESPACE_DEPTH, Operation,
-    PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_BACKUP, RateLimitConfig, Remote, SnapshotListItem,
-    VerifyState, print_store_and_ns,
+    PRIV_DATASTORE_APPEND, PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_BACKUP, RateLimitConfig, Remote,
+    SnapshotListItem, VerifyState, print_store_and_ns,
 };
 use pbs_client::BackupRepository;
 use pbs_config::CachedUserInfo;
@@ -1438,7 +1438,7 @@ fn check_and_create_ns(params: &PullParameters, ns: &BackupNamespace) -> Result<
     let store_ns_str = print_store_and_ns(params.target.store.name(), ns);
 
     if !ns.is_root() && !params.target.store.namespace_path(ns).exists() {
-        check_ns_modification_privs(params.target.store.name(), ns, &params.owner)
+        check_ns_modification_privs(params.target.store.name(), ns, &params.owner, false)
             .map_err(|err| format_err!("Creating {ns} not allowed - {err}"))?;
 
         let name = match ns.components().last() {
@@ -1458,7 +1458,7 @@ fn check_and_create_ns(params: &PullParameters, ns: &BackupNamespace) -> Result<
         params.target.store.name(),
         ns,
         &params.owner,
-        PRIV_DATASTORE_BACKUP,
+        PRIV_DATASTORE_BACKUP | PRIV_DATASTORE_APPEND,
     )
     .map_err(|err| format_err!("sync into {store_ns_str} not allowed - {err}"))?;
 
@@ -1466,7 +1466,7 @@ fn check_and_create_ns(params: &PullParameters, ns: &BackupNamespace) -> Result<
 }
 
 fn check_and_remove_ns(params: &PullParameters, local_ns: &BackupNamespace) -> Result<bool, Error> {
-    check_ns_modification_privs(params.target.store.name(), local_ns, &params.owner)
+    check_ns_modification_privs(params.target.store.name(), local_ns, &params.owner, true)
         .map_err(|err| format_err!("Removing {local_ns} not allowed - {err}"))?;
 
     // The outer loop (check_and_remove_vanished_ns) iterates children first, so we only need
-- 
2.47.3