From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 290451FF0AF for ; Fri, 06 Nov 2026 18:23:48 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id EF2AF2176C; Fri, 06 Nov 2026 18:23:17 +0100 (CET) From: Christian Ebner To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup v2 21/43] sync: pull: allow pulling for user/token with append permission Date: Fri, 6 Nov 2026 18:22:13 +0100 Message-ID: <20261106172235.890542-22-c.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261106172235.890542-1-c.ebner@proxmox.com> References: <20261106172235.890542-1-c.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793985776854 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.465 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: GNEIVXCJVSQBNZLGMYEH64QXODRRSNAD X-Message-ID-Hash: GNEIVXCJVSQBNZLGMYEH64QXODRRSNAD X-MailFrom: c.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Extends the access checks for syncs in pull direction to allow appending contents when user has Datastore.Append permissions. Resync of corrupt snapshots is not allowed without Datastore.Backup privileges, as that is a modification not append and will not work if the lifecycle is enforced by the storage backend anyways. Instead of a failure, skip the resync and log this as warning so it is notable in the task state and log. Signed-off-by: Christian Ebner --- src/api2/pull.rs | 10 +++++----- src/server/pull.rs | 16 ++++++++++++++++ 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/src/api2/pull.rs b/src/api2/pull.rs index 17c1e4f34..6b53c55b7 100644 --- a/src/api2/pull.rs +++ b/src/api2/pull.rs @@ -8,9 +8,9 @@ use proxmox_schema::api; use pbs_api_types::{ Authid, BackupNamespace, CRYPT_KEY_ID_SCHEMA, DATASTORE_SCHEMA, GROUP_FILTER_LIST_SCHEMA, - GroupFilter, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_PRUNE, - PRIV_REMOTE_READ, REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA, RESYNC_CORRUPT_SCHEMA, - RateLimitConfig, SYNC_ENCRYPTED_ONLY_SCHEMA, SYNC_VERIFIED_ONLY_SCHEMA, + GroupFilter, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_APPEND, PRIV_DATASTORE_BACKUP, + PRIV_DATASTORE_PRUNE, PRIV_REMOTE_READ, REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA, + RESYNC_CORRUPT_SCHEMA, RateLimitConfig, SYNC_ENCRYPTED_ONLY_SCHEMA, SYNC_VERIFIED_ONLY_SCHEMA, SYNC_WORKER_THREADS_SCHEMA, SyncJobConfig, TRANSFER_LAST_SCHEMA, }; use pbs_config::CachedUserInfo; @@ -36,8 +36,8 @@ pub fn check_pull_privs( user_info.check_privs( auth_id, &local_store_ns_acl_path, - PRIV_DATASTORE_BACKUP, - false, + PRIV_DATASTORE_APPEND | PRIV_DATASTORE_BACKUP, + true, )?; if let Some(remote) = remote { diff --git a/src/server/pull.rs b/src/server/pull.rs index b7b28c3d5..33f75c9c5 100644 --- a/src/server/pull.rs +++ b/src/server/pull.rs @@ -1090,6 +1090,22 @@ async fn pull_snapshot_from<'a>( .create_locked_backup_dir(snapshot.backup_ns(), snapshot.as_ref()) .context(prefix.clone())?; + if !is_new && corrupt { + // only allow re-sync of corrupt snapshots with backup privileges, append only is not enough + let acl_path = snapshot.backup_ns().acl_path(snapshot.datastore().name()); + let user_info = CachedUserInfo::new()?; + let privs = user_info.lookup_privs(¶ms.owner, &acl_path); + if privs & PRIV_DATASTORE_BACKUP == 0 { + log_sender + .log( + Level::WARN, + format!("{prefix}: skip re-sync of corrupt snapshot, missing 'Datastore.Backup' privileges"), + ) + .await?; + return Ok(SyncStats::default()); + } + } + let result = pull_snapshot( params, reader, -- 2.47.3