Re: [PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[Dominik Csapak <d.csapak@proxmox.com>]

On 7/8/26 1:24 PM, Dominik Csapak wrote:
> 
> 
> On 7/8/26 12:40 PM, Fabian Grünbichler wrote:
>> the wrong path was copied over from the node shell, and since there is no
>> "node" parameter here, calls as non-root will fail with 403..
>>
>> Fixes: 525c8c49 "server: add termproxy and vncwebsocket calls for qemu 
>> guests"
>>
>> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
>> ---
>> 403 if the API schema is actually invalid might be something to catch
>> lower in the stack as well?
> 
> i guess the substitution fails during privilege check in proxmox-router
> and that triggers a 403 higher up in the stack?
> 
> since that must be const, maybe there can be a compile time check that
> the parameters must exist here?
> 

had a short stab at this and this does indeed work:
https://lore.proxmox.com/pdm-devel/20260708133630.1807997-1-d.csapak@proxmox.com/T/#t

it also found a third place where we used a non existant parameter
(2/2 in that series)

>>
>>   server/src/api/pve/lxc.rs  | 4 ++--
>>   server/src/api/pve/qemu.rs | 4 ++--
>>   2 files changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
>> index 6183f62d..ca32eb84 100644
>> --- a/server/src/api/pve/lxc.rs
>> +++ b/server/src/api/pve/lxc.rs
>> @@ -807,9 +807,9 @@ pub const API_METHOD_LXC_WEBSOCKET: ApiMethod = 
>> ApiMethod::new(
>>       ),
>>   )
>>   .access(
>> -    Some("The user needs Sys.Console on /resource/{remote}/node/ 
>> {node}."),
>> +    Some("The user needs Sys.Console on /resource/{remote}/guest/ 
>> {vmid}."),
>>       &Permission::Privilege(
>> -        &["resource", "{remote}", "node", "{node}"],
>> +        &["resource", "{remote}", "guest", "{vmid}"],
>>           PRIV_SYS_CONSOLE,
>>           false,
>>       ),
>> diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
>> index 65de6389..5d01e69e 100644
>> --- a/server/src/api/pve/qemu.rs
>> +++ b/server/src/api/pve/qemu.rs
>> @@ -895,9 +895,9 @@ pub const API_METHOD_QEMU_WEBSOCKET: ApiMethod = 
>> ApiMethod::new(
>>       ),
>>   )
>>   .access(
>> -    Some("The user needs Sys.Console on /resource/{remote}/node/ 
>> {node}."),
>> +    Some("The user needs Sys.Console on /resource/{remote}/guest/ 
>> {vmid}."),
>>       &Permission::Privilege(
>> -        &["resource", "{remote}", "node", "{node}"],
>> +        &["resource", "{remote}", "guest", "{vmid}"],
>>           PRIV_SYS_CONSOLE,
>>           false,
>>       ),
> 
> 
> 
> 
>