[pve-devel] [PATCH-SERIES v2 manager/storage/container/qemu-server] improve check_volume_access

[Fabian Ebner <f.ebner@proxmox.com>]

The first few patches are to allow access for users with
Datastore.Allocate privilege, without automatically giving them
permission to extract a backup config.

Patch storage 3/6 is in preparation for the import-from API, allowing
users with VM.Config.Disk (and Datastore.Audit) to list images of
their VMs.

The rest of the series introduces a content type parameter to
check_volume_access() for future-proofing.

Patch storage 2/6 technically breaks older manager, allowing all users
with Datastore.Allocate to extract backup configs, but I'm not sure
that's worth bothering about.

Dependency bumps for storage are needed for the content parameter to
actually have an effect.


Changes from v1:
    * Always allow with Datastore.Allocate privilege.
    * Also check for Datastore.Audit when listing guest images/rootdir
      rather than just VM.Config.Disk.


manager:

Fabian Ebner (3):
  api: vzdump: extract config: check for VM.Backup privilege
  pveam: remove: add content type check
  api: vzdump: extract config: add content type check

 PVE/API2/VZDump.pm | 14 +++++++++++++-
 PVE/CLI/pveam.pm   |  2 +-
 2 files changed, 14 insertions(+), 2 deletions(-)


storage:

Fabian Ebner (6):
  pvesm: extract config: check for VM.Backup privilege
  check volume access: always allow with Datastore.Allocate privilege
  check volume access: allow for images/rootdir if user has
    VM.Config.Disk
  check volume accesss: add content type parameter
  pvesm: extract config: add content type check
  api: file restore: use check_volume_access to restrict content type

 PVE/API2/Storage/FileRestore.pm | 12 ++++--------
 PVE/CLI/pvesm.pm                | 14 +++++++++++++-
 PVE/Storage.pm                  | 15 ++++++++++++---
 3 files changed, 29 insertions(+), 12 deletions(-)


container:

Fabian Ebner (1):
  api: create/modify: add content type checks

 src/PVE/API2/LXC.pm | 10 +++++++++-
 src/PVE/LXC.pm      |  9 ++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)


qemu-server:

Fabian Ebner (1):
  api: create/modify: add content type checks

 PVE/API2/Qemu.pm | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

-- 
2.30.2