* [pdm-devel] [PATCH datacenter-manager v2 0/3] fix #6901: allow non root users to access the EVPN dashboard
@ 2025-10-17 13:02 Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] fix #6901: api: add explicit permission check for controllers list Shan Shaji
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Shan Shaji @ 2025-10-17 13:02 UTC (permalink / raw)
To: pdm-devel
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=yes, Size: 1217 bytes --]
When a non-root user tried to access the EVPN section, the API was
returning a "403: permission check failed" error. To fix this, explicit
permission checks have been added for the `/zones`, `/vnets`, and
`/controllers` endpoints.
Now, every authenticated user can access these endpoints however, the user
must have at least the Resource.Audit permission under `/resource`.
Remotes are also filtered based on the user’s access. Lists will only be
fetched from remotes for which the user has at least the
`Resource.Audit` permission on `/remote/{remote_name}`.
changes since v1: thanks @stefan
patch: https://lore.proxmox.com/pdm-devel/DDKKKUCY3S4R.1FDPCH2742RY5@proxmox.com/T/#t
- Removed unused import from vnets.rs file.
Shan Shaji (3):
fix #6901: api: add explicit permission check for controllers list
fix #6901: api: add explicit permission check for vnets list
fix #6901: api: add explicit permission check for zones list
server/src/api/sdn/controllers.rs | 30 ++++++++++++++++++++++++++----
server/src/api/sdn/vnets.rs | 28 +++++++++++++++++++++++++---
server/src/api/sdn/zones.rs | 28 +++++++++++++++++++++++++---
3 files changed, 76 insertions(+), 10 deletions(-)
--
2.47.3
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* [pdm-devel] [PATCH datacenter-manager v2 1/3] fix #6901: api: add explicit permission check for controllers list
2025-10-17 13:02 [pdm-devel] [PATCH datacenter-manager v2 0/3] fix #6901: allow non root users to access the EVPN dashboard Shan Shaji
@ 2025-10-17 13:02 ` Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 2/3] fix #6901: api: add explicit permission check for vnets list Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 3/3] fix #6901: api: add explicit permission check for zones list Shan Shaji
2 siblings, 0 replies; 4+ messages in thread
From: Shan Shaji @ 2025-10-17 13:02 UTC (permalink / raw)
To: pdm-devel
When a non-root user tried to access the EVPN section, the API was
throwing "403: permission check failed" error. To fix this, add
explicit permission check for the `/controller` endpoint.
Now every authenticated user can access the endpoint however, the user
needs to have at least `Resource.Audit` permission under `/resource`.
Only the controllers from remotes which the user has `Resource.Audit`
privilege on `/remote/{remote_name}` will be included in the returned
list.
Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
server/src/api/sdn/controllers.rs | 30 ++++++++++++++++++++++++++----
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/server/src/api/sdn/controllers.rs b/server/src/api/sdn/controllers.rs
index 271397a..649d668 100644
--- a/server/src/api/sdn/controllers.rs
+++ b/server/src/api/sdn/controllers.rs
@@ -1,10 +1,11 @@
use std::collections::HashSet;
-use anyhow::Error;
+use anyhow::{format_err, Error};
use pbs_api_types::REMOTE_ID_SCHEMA;
-use pdm_api_types::{remotes::RemoteType, sdn::ListController};
-use proxmox_router::Router;
+use pdm_api_types::{remotes::RemoteType, sdn::ListController, Authid, PRIV_RESOURCE_AUDIT};
+use proxmox_access_control::CachedUserInfo;
+use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
use proxmox_schema::api;
use pve_api_types::ListControllersType;
@@ -49,6 +50,12 @@ pub const ROUTER: Router = Router::new().get(&API_METHOD_LIST_CONTROLLERS);
type: ListController,
},
},
+ access: {
+ permission: &Permission::Anybody,
+ description: "The user needs to have at least the `Resource.Audit` privilege under `/resource`.
+ Only controllers from remotes for which the user has `Resource.Audit` on `/remote/{remote_name}`
+ will be included in the returned list."
+ }
)]
/// Query controllers of remotes with optional filtering options
pub async fn list_controllers(
@@ -56,10 +63,25 @@ pub async fn list_controllers(
running: Option<bool>,
ty: Option<ListControllersType>,
remotes: Option<HashSet<String>>,
+ rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<ListController>, Error> {
+ let user_info = CachedUserInfo::new()?;
+
+ let auth_id: Authid = rpcenv
+ .get_auth_id()
+ .ok_or_else(|| format_err!("no authid available"))?
+ .parse()?;
+
+ if !user_info.any_privs_below(&auth_id, &["resource"], PRIV_RESOURCE_AUDIT)? {
+ http_bail!(FORBIDDEN, "user has no access to resources");
+ }
+
let (remote_config, _) = pdm_config::remotes::config()?;
+ let authorized_remotes = remote_config.into_iter().filter(|(remote_name, _)| {
+ user_info.lookup_privs(&auth_id, &["resource", &remote_name]) & PRIV_RESOURCE_AUDIT != 0
+ });
- let filtered_remotes = remote_config.into_iter().filter_map(|(_, remote)| {
+ let filtered_remotes = authorized_remotes.filter_map(|(_, remote)| {
if remote.ty == RemoteType::Pve
&& remotes
.as_ref()
--
2.47.3
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* [pdm-devel] [PATCH datacenter-manager v2 2/3] fix #6901: api: add explicit permission check for vnets list
2025-10-17 13:02 [pdm-devel] [PATCH datacenter-manager v2 0/3] fix #6901: allow non root users to access the EVPN dashboard Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] fix #6901: api: add explicit permission check for controllers list Shan Shaji
@ 2025-10-17 13:02 ` Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 3/3] fix #6901: api: add explicit permission check for zones list Shan Shaji
2 siblings, 0 replies; 4+ messages in thread
From: Shan Shaji @ 2025-10-17 13:02 UTC (permalink / raw)
To: pdm-devel
When a non-root user tried to access the EVPN section, the API was
throwing "403: permission check failed" error. To fix this, add
explicit permission check for the `/vnets` endpoint.
Now every authenticated user can access the endpoint however, the user
needs to have at least `Resource.Audit` permission under `/resource`.
Only the vnets from remotes which the user has `Resource.Audit`
privilege on `/remote/{remote_name}` will be included in the returned
list.
Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
changes since v1: Thanks @Stefan
- removed unused import
server/src/api/sdn/vnets.rs | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
diff --git a/server/src/api/sdn/vnets.rs b/server/src/api/sdn/vnets.rs
index a8092cf..8e9e7d0 100644
--- a/server/src/api/sdn/vnets.rs
+++ b/server/src/api/sdn/vnets.rs
@@ -5,10 +5,11 @@ use pbs_api_types::REMOTE_ID_SCHEMA;
use pdm_api_types::{
remotes::RemoteType,
sdn::{CreateVnetRemote, ListVnet, SDN_ID_SCHEMA, VXLAN_ID_SCHEMA},
- Authid,
+ Authid, PRIV_RESOURCE_AUDIT,
};
+use proxmox_access_control::CachedUserInfo;
use proxmox_rest_server::WorkerTask;
-use proxmox_router::{Router, RpcEnvironment};
+use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
use proxmox_schema::api;
use pve_api_types::{CreateVnet, SdnVnetType};
@@ -52,16 +53,37 @@ pub const ROUTER: Router = Router::new()
type: ListVnet,
},
},
+ access: {
+ permission: &Permission::Anybody,
+ description: "The user needs to have at least the `Resource.Audit` privilege under `/resource`.
+ Only vnets from remotes for which the user has `Resource.Audit` on `/remote/{remote_name}`
+ will be included in the returned list."
+ }
)]
/// Query VNets of PVE remotes with optional filtering options
async fn list_vnets(
pending: Option<bool>,
running: Option<bool>,
remotes: Option<HashSet<String>>,
+ rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<ListVnet>, Error> {
+ let user_info = CachedUserInfo::new()?;
+
+ let auth_id: Authid = rpcenv
+ .get_auth_id()
+ .ok_or_else(|| format_err!("no authid available"))?
+ .parse()?;
+
+ if !user_info.any_privs_below(&auth_id, &["resource"], PRIV_RESOURCE_AUDIT)? {
+ http_bail!(FORBIDDEN, "user has no access to resources");
+ }
+
let (remote_config, _) = pdm_config::remotes::config()?;
+ let authorized_remotes = remote_config.into_iter().filter(|(remote_name, _)| {
+ user_info.lookup_privs(&auth_id, &["resource", &remote_name]) & PRIV_RESOURCE_AUDIT != 0
+ });
- let filtered_remotes = remote_config.into_iter().filter_map(|(_, remote)| {
+ let filtered_remotes = authorized_remotes.filter_map(|(_, remote)| {
if remote.ty == RemoteType::Pve
&& remotes
.as_ref()
--
2.47.3
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* [pdm-devel] [PATCH datacenter-manager v2 3/3] fix #6901: api: add explicit permission check for zones list
2025-10-17 13:02 [pdm-devel] [PATCH datacenter-manager v2 0/3] fix #6901: allow non root users to access the EVPN dashboard Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] fix #6901: api: add explicit permission check for controllers list Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 2/3] fix #6901: api: add explicit permission check for vnets list Shan Shaji
@ 2025-10-17 13:02 ` Shan Shaji
2 siblings, 0 replies; 4+ messages in thread
From: Shan Shaji @ 2025-10-17 13:02 UTC (permalink / raw)
To: pdm-devel
When a non-root user tried to access the EVPN section, the API was
throwing "403: permission check failed" error. To fix this, add
explicit permission check for the `/zones` endpoint.
Now every authenticated user can access the endpoint however, the user
needs to have at least `Resource.Audit` permission under `/resource`.
Only the zones from remotes which the user has `Resource.Audit`
privilege on `/remote/{remote_name}` will be included in the returned
list.
Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
server/src/api/sdn/zones.rs | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
diff --git a/server/src/api/sdn/zones.rs b/server/src/api/sdn/zones.rs
index 5e0ec54..60fae20 100644
--- a/server/src/api/sdn/zones.rs
+++ b/server/src/api/sdn/zones.rs
@@ -6,10 +6,11 @@ use pbs_api_types::REMOTE_ID_SCHEMA;
use pdm_api_types::{
remotes::RemoteType,
sdn::{CreateZoneRemote, ListZone, SDN_ID_SCHEMA, VXLAN_ID_SCHEMA},
- Authid,
+ Authid, PRIV_RESOURCE_AUDIT,
};
+use proxmox_access_control::CachedUserInfo;
use proxmox_rest_server::WorkerTask;
-use proxmox_router::{Router, RpcEnvironment};
+use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
use proxmox_schema::api;
use pve_api_types::{CreateZone, ListZonesType};
@@ -57,6 +58,12 @@ pub const ROUTER: Router = Router::new()
type: ListZone,
},
},
+ access: {
+ permission: &Permission::Anybody,
+ description: "The user needs to have at least the `Resource.Audit` privilege under `/resource`.
+ Only zones from remotes for which the user has `Resource.Audit` on `/remote/{remote_name}`
+ will be included in the returned list."
+ }
)]
/// Query zones of remotes with optional filtering options
pub async fn list_zones(
@@ -64,10 +71,25 @@ pub async fn list_zones(
running: Option<bool>,
ty: Option<ListZonesType>,
remotes: Option<HashSet<String>>,
+ rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<ListZone>, Error> {
+ let user_info = CachedUserInfo::new()?;
+
+ let auth_id: Authid = rpcenv
+ .get_auth_id()
+ .ok_or_else(|| format_err!("no authid available"))?
+ .parse()?;
+
+ if !user_info.any_privs_below(&auth_id, &["resource"], PRIV_RESOURCE_AUDIT)? {
+ http_bail!(FORBIDDEN, "user has no access to resources");
+ }
+
let (remote_config, _) = pdm_config::remotes::config()?;
+ let authorized_remotes = remote_config.into_iter().filter(|(remote_name, _)| {
+ user_info.lookup_privs(&auth_id, &["resource", &remote_name]) & PRIV_RESOURCE_AUDIT != 0
+ });
- let filtered_remotes = remote_config.into_iter().filter_map(|(_, remote)| {
+ let filtered_remotes = authorized_remotes.filter_map(|(_, remote)| {
if remote.ty == RemoteType::Pve
&& remotes
.as_ref()
--
2.47.3
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-10-17 13:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-10-17 13:02 [pdm-devel] [PATCH datacenter-manager v2 0/3] fix #6901: allow non root users to access the EVPN dashboard Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] fix #6901: api: add explicit permission check for controllers list Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 2/3] fix #6901: api: add explicit permission check for vnets list Shan Shaji
2025-10-17 13:02 ` [pdm-devel] [PATCH datacenter-manager v2 3/3] fix #6901: api: add explicit permission check for zones list Shan Shaji
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox