public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* [pve-devel] [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge
@ 2023-06-07 12:03 Alexandre Derumier
  2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-access-control 1/3] access control: add /sdn/zones/<zone>/<vnet>/<vlan> path Alexandre Derumier
                   ` (10 more replies)
  0 siblings, 11 replies; 31+ messages in thread
From: Alexandre Derumier @ 2023-06-07 12:03 UTC (permalink / raw)
  To: pve-devel

add vnet/localbridge permissions management

Hi,
as we has discuted some weeks ago,
this patche serie introduce management of acl for vnets && local bridges

The permission path is:

/sdn/zones/<zone>/<vnet>

where the local vmbr are in a virtual "localnetwork" zone

/sdn/zones/localnetwork/<vnet>

Vlans permissions  are also handled with
/sdn/zones/<zone>/<vnet>/<tag>

if user have permissions on the vnet/tag, he have access to only the specific vlan.
if user have permissions on the vnet with propagate, he have access to all vlans of the vnet
if user have permissions on the vnet without propagate, he have access to bridge only without any vlan


I have reworked the sdn zone panel from the tree, to manage permissions
on displayed vnets. (patch 3 && 4 pve-manager)

some screenshots:

https://mutulin1.odiso.net/sdnzone-perm.png
https://mutulin1.odiso.net/localzone-perm.png



changelog v2:
 - use /vnets/vlan instead /vnets.vlan
 - rework the bridge filtering when user have access only to a specific vlan
 - api2 network: always check bridge access if no filter is defined

changelog v3:
 - use /sdn/zones/<zone>/vnets/vlan instead /sdn/vnets/vnets.vlan
 - add SDN.Use permission
 - pve-manager: split ui code (could be applied later)
 - remove check on zone (it's now propagate with new path)
 - move check_vnet_access to pve-guest-common for lxc reuse
 - pve-network: fix vnet/tag perm check

changelog v4:
 - qemu-server: check permissions on backup restore
 - guest-common: check trunks permissions

todo:
 - implement lxc check permissions



pve-access-control:

Alexandre Derumier (3):
  access control: add /sdn/zones/<zone>/<vnet>/<vlan> path
  rpcenvironnment: add check_sdn_bridge
  add new SDN.use privilege in PVESDNUser role

 src/PVE/AccessControl.pm  |  6 +++++-
 src/PVE/RPCEnvironment.pm | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

pve-manager:

Alexandre Derumier (4):
  api2: network: check permissions for local bridges
  api2: cluster: ressources: add "localnetwork" zone
  ui: add vnet permissions panel
  ui: add permissions management for "localnetwork" zone

 PVE/API2/Cluster.pm                  |  14 ++
 PVE/API2/Network.pm                  |  25 ++-
 www/manager6/Makefile                |   2 +
 www/manager6/sdn/Browser.js          |  17 +-
 www/manager6/sdn/VnetACLView.js      | 289 +++++++++++++++++++++++++++
 www/manager6/sdn/ZoneContentPanel.js |  41 ++++
 www/manager6/sdn/ZoneContentView.js  |  52 ++++-
 7 files changed, 411 insertions(+), 29 deletions(-)
 create mode 100644 www/manager6/sdn/VnetACLView.js
 create mode 100644 www/manager6/sdn/ZoneContentPanel.js

pve-guest-common:

Alexandre Derumier (1):
  helpers : add check_vnet_access

 src/PVE/GuestHelpers.pm | 49 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

qemu-server:

Alexandre Derumier (1):
  api2: add check_bridge_access for create/update/clone/restore vm

 PVE/API2/Qemu.pm | 33 +++++++++++++++++++++++++++++----
 1 file changed, 29 insertions(+), 4 deletions(-)


pve-network:

Alexandre Derumier (1):
  get_local_vnets: fix permission path && perm

 PVE/Network/SDN.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.30.2




^ permalink raw reply	[flat|nested] 31+ messages in thread
* [pve-devel] [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge
@ 2023-06-06 13:19 Alexandre Derumier
  2023-06-06 13:19 ` [pve-devel] [PATCH pve-network 1/1] get_local_vnets: fix permission path && perm Alexandre Derumier
  0 siblings, 1 reply; 31+ messages in thread
From: Alexandre Derumier @ 2023-06-06 13:19 UTC (permalink / raw)
  To: pve-devel

add vnet/localbridge permissions management

Hi,
as we has discuted some weeks ago,
this patche serie introduce management of acl for vnets && local bridges

The permission path is:

/sdn/zones/<zone>/<vnet>

where the local vmbr are in a virtual "localnetwork" zone

/sdn/zones/localnetwork/<vnet>

Vlans permissions  are also handled with
/sdn/zones/<zone>/<vnet>/<tag>

if user have permissions on the vnet/tag, he have access to only the specific vlan.
if user have permissions on the vnet with propagate, he have access to all vlans of the vnet
if user have permissions on the vnet without propagate, he have access to bridge only without any vlan


I have reworked the sdn zone panel from the tree, to manage permissions
on displayed vnets. (patch 3 && 4 pve-manager)

some screenshots:

https://mutulin1.odiso.net/sdnzone-perm.png
https://mutulin1.odiso.net/localzone-perm.png



changelog v2:
 - use /vnets/vlan instead /vnets.vlan
 - rework the bridge filtering when user have access only to a specific vlan
 - api2 network: always check bridge access if no filter is defined

changelog v3:
 - use /sdn/zones/<zone>/vnets/vlan instead /sdn/vnets/vnets.vlan
 - add SDN.Use permission
 - pve-manager: split ui code (could be applied later)
 - remove check on zone (it's now propagate with new path)
 - move check_vnet_access to pve-guest-common for lxc reuse
 - pve-network: fix vnet/tag perm check

todo:
 - implement check permissions on trunks
 - qemu : check bridge permissions on restore. (how to check restore config before restore ?)
 - lxc: check bridge permissions


pve-access-control:

Alexandre Derumier (3):
  access control: add /sdn/zones/<zone>/<vnet>/<vlan> path
  rpcenvironnment: add check_sdn_bridge
  add new SDN.use privilege in PVESDNUser role

 src/PVE/AccessControl.pm  |  6 +++++-
 src/PVE/RPCEnvironment.pm | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

pve-manager:

Alexandre Derumier (4):
  api2: network: check permissions for local bridges
  api2: cluster: ressources: add "localnetwork" zone
  ui: add vnet permissions panel
  ui: add permissions management for "localnetwork" zone

 PVE/API2/Cluster.pm                  |  14 ++
 PVE/API2/Network.pm                  |  25 ++-
 www/manager6/Makefile                |   2 +
 www/manager6/sdn/Browser.js          |  17 +-
 www/manager6/sdn/VnetACLView.js      | 289 +++++++++++++++++++++++++++
 www/manager6/sdn/ZoneContentPanel.js |  41 ++++
 www/manager6/sdn/ZoneContentView.js  |  52 ++++-
 7 files changed, 411 insertions(+), 29 deletions(-)
 create mode 100644 www/manager6/sdn/VnetACLView.js
 create mode 100644 www/manager6/sdn/ZoneContentPanel.js


pve-guest-common:

Alexandre Derumier (1):
  helpers : add check_vnet_access

 src/PVE/GuestHelpers.pm | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

qemu-server:

Alexandre Derumier (1):
  api2: add check_bridge_access for create/update/clone vm

 PVE/API2/Qemu.pm | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

pve-network:

Alexandre Derumier (1):
  get_local_vnets: fix permission path && perm

 PVE/Network/SDN.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.30.2




^ permalink raw reply	[flat|nested] 31+ messages in thread

end of thread, other threads:[~2023-06-12 14:40 UTC | newest]

Thread overview: 31+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-07 12:03 [pve-devel] [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge Alexandre Derumier
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-access-control 1/3] access control: add /sdn/zones/<zone>/<vnet>/<vlan> path Alexandre Derumier
2023-06-07 14:41   ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH v4 qemu-server 1/1] api2: add check_bridge_access for create/update/clone/restore vm Alexandre Derumier
2023-06-07 14:52   ` Fabian Grünbichler
2023-06-07 16:46     ` DERUMIER, Alexandre
2023-06-08 16:02   ` [pve-devel] applied: " Thomas Lamprecht
2023-06-09  7:00     ` DERUMIER, Alexandre
2023-06-09  7:14       ` DERUMIER, Alexandre
2023-06-09  7:29         ` Thomas Lamprecht
2023-06-09  8:28           ` DERUMIER, Alexandre
2023-06-09  7:26       ` Thomas Lamprecht
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 1/4] api2: network: check permissions for local bridges Alexandre Derumier
2023-06-07 14:45   ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH pve-network 1/1] get_local_vnets: fix permission path && perm Alexandre Derumier
2023-06-07 14:56   ` Fabian Grünbichler
2023-06-07 16:27     ` DERUMIER, Alexandre
2023-06-08  1:34     ` DERUMIER, Alexandre
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-guest-common 1/1] helpers : add check_vnet_access Alexandre Derumier
2023-06-07 14:48   ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 2/4] api2: cluster: ressources: add "localnetwork" zone Alexandre Derumier
2023-06-07 14:44   ` Fabian Grünbichler
2023-06-07 17:18     ` DERUMIER, Alexandre
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-access-control 2/3] rpcenvironnment: add check_sdn_bridge Alexandre Derumier
2023-06-07 14:41   ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-access-control 3/3] add new SDN.use privilege in PVESDNUser role Alexandre Derumier
2023-06-07 14:42   ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 3/4] ui: add vnet permissions panel Alexandre Derumier
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 4/4] ui: add permissions management for "localnetwork" zone Alexandre Derumier
2023-06-12 14:39 ` [pve-devel] applied-series: [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge Fabian Grünbichler
  -- strict thread matches above, loose matches on Subject: below --
2023-06-06 13:19 [pve-devel] " Alexandre Derumier
2023-06-06 13:19 ` [pve-devel] [PATCH pve-network 1/1] get_local_vnets: fix permission path && perm Alexandre Derumier

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal