[PATCH proxmox-backup v2 22/43] sync: push: allow push and ns creation on Remote.DatastoreAppend

[Christian Ebner <c.ebner@proxmox.com>]

A local sync job user with Remote.DatastoreAppend permissions is
intended to be able to append backups on the remote just like
Remote.DatastoreBackup, but also create namespaces not present on
the remote, which would otherwise require Remote.DatastoreModify.
The latter would however also allow for namespace destruction, so
cannot be used for this.

These are push job source checks only, the user connecting to the
remote as configured in the remote config must be setup on the
target PBS instance accordingly (i.e. with Datastore.Audit and
Datastore.Append on the target datastore and sub-namespace).

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/api2/config/sync.rs |  6 +++---
 src/api2/push.rs        |  8 ++++----
 src/server/push.rs      | 13 ++++++++-----
 3 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
index a9a86abd5..7ed624c9f 100644
--- a/src/api2/config/sync.rs
+++ b/src/api2/config/sync.rs
@@ -9,8 +9,8 @@ use proxmox_schema::{api, param_bail};
 use pbs_api_types::{
     Authid, JOB_ID_SCHEMA, PRIV_DATASTORE_APPEND, PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_BACKUP,
     PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE, PRIV_DATASTORE_READ, PRIV_REMOTE_AUDIT,
-    PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE, PRIV_REMOTE_READ,
-    PROXMOX_CONFIG_DIGEST_SCHEMA, SyncJobConfig, SyncJobConfigUpdater,
+    PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE,
+    PRIV_REMOTE_READ, PROXMOX_CONFIG_DIGEST_SCHEMA, SyncJobConfig, SyncJobConfigUpdater,
 };
 use pbs_config::sync;
 
@@ -171,7 +171,7 @@ pub fn check_sync_job_modify_access(
             };
 
             // check user is allowed to create backups on remote datastore
-            if target_privs & PRIV_REMOTE_DATASTORE_BACKUP == 0 {
+            if target_privs & (PRIV_REMOTE_DATASTORE_BACKUP | PRIV_REMOTE_DATASTORE_APPEND) == 0 {
                 return false;
             }
 
diff --git a/src/api2/push.rs b/src/api2/push.rs
index 16bcdf85b..8d053c00e 100644
--- a/src/api2/push.rs
+++ b/src/api2/push.rs
@@ -4,8 +4,8 @@ use futures::{future::FutureExt, select};
 use pbs_api_types::{
     Authid, BackupNamespace, CRYPT_KEY_ID_SCHEMA, DATASTORE_SCHEMA, GROUP_FILTER_LIST_SCHEMA,
     GroupFilter, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_READ,
-    PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE, REMOTE_ID_SCHEMA,
-    REMOVE_VANISHED_BACKUPS_SCHEMA, RateLimitConfig, SYNC_ENCRYPTED_ONLY_SCHEMA,
+    PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE,
+    REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA, RateLimitConfig, SYNC_ENCRYPTED_ONLY_SCHEMA,
     SYNC_VERIFIED_ONLY_SCHEMA, SYNC_WORKER_THREADS_SCHEMA, TRANSFER_LAST_SCHEMA,
 };
 use proxmox_rest_server::WorkerTask;
@@ -35,8 +35,8 @@ fn check_push_privs(
     user_info.check_privs(
         auth_id,
         &target_acl_path,
-        PRIV_REMOTE_DATASTORE_BACKUP,
-        false,
+        PRIV_REMOTE_DATASTORE_BACKUP | PRIV_REMOTE_DATASTORE_APPEND,
+        true,
     )?;
 
     if delete {
diff --git a/src/server/push.rs b/src/server/push.rs
index 98f843a49..c99975a2b 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -15,8 +15,9 @@ use pbs_api_types::{
     ApiVersion, ApiVersionInfo, ArchiveType, Authid, BackupArchiveName, BackupDir, BackupGroup,
     BackupGroupDeleteStats, BackupNamespace, CLIENT_LOG_BLOB_NAME, CryptMode, GroupFilter,
     GroupListItem, MANIFEST_BLOB_NAME, NamespaceListItem, Operation, PRIV_DATASTORE_BACKUP,
-    PRIV_DATASTORE_READ, PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_MODIFY,
-    PRIV_REMOTE_DATASTORE_PRUNE, RateLimitConfig, Remote, SnapshotListItem, print_store_and_ns,
+    PRIV_DATASTORE_READ, PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP,
+    PRIV_REMOTE_DATASTORE_MODIFY, PRIV_REMOTE_DATASTORE_PRUNE, RateLimitConfig, Remote,
+    SnapshotListItem, print_store_and_ns,
 };
 use pbs_client::{
     BackupRepository, BackupStats, BackupWriter, BackupWriterOptions, HttpClient, IndexType,
@@ -215,7 +216,7 @@ fn check_ns_remote_datastore_privs(
     let acl_path =
         target_namespace.remote_acl_path(&params.target.remote.name, params.target.repo.store());
 
-    user_info.check_privs(&params.local_user, &acl_path, privs, false)?;
+    user_info.check_privs(&params.local_user, &acl_path, privs, true)?;
 
     Ok(())
 }
@@ -357,7 +358,8 @@ async fn check_or_create_target_namespace(
         // Namespace not present on target, create namespace.
         // Sub-namespaces have to be created by creating parent components first.
 
-        check_ns_remote_datastore_privs(params, target_namespace, PRIV_REMOTE_DATASTORE_MODIFY)
+        let privs = PRIV_REMOTE_DATASTORE_MODIFY | PRIV_REMOTE_DATASTORE_APPEND;
+        check_ns_remote_datastore_privs(params, target_namespace, privs)
             .context("Creating remote namespace not allowed")?;
 
         let mut parent = BackupNamespace::root();
@@ -554,7 +556,8 @@ pub(crate) async fn push_namespace(
 ) -> Result<(StoreProgress, SyncStats, bool), Error> {
     let target_namespace = params.map_to_target(namespace)?;
     // Check if user is allowed to perform backups on remote datastore
-    check_ns_remote_datastore_privs(&params, &target_namespace, PRIV_REMOTE_DATASTORE_BACKUP)
+    let privs = PRIV_REMOTE_DATASTORE_BACKUP | PRIV_REMOTE_DATASTORE_APPEND;
+    check_ns_remote_datastore_privs(&params, &target_namespace, privs)
         .context("Pushing to remote namespace not allowed")?;
 
     let mut list: Vec<BackupGroup> = params
-- 
2.47.3