[pve-devel] [PATCH v3 access-control 04/17] api: roles: only allow modifying roles to add/remove SU if user has SU themselves

[Oguz Bektas <o.bektas@proxmox.com>]

Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
---
v2->v3:
* also check if previous role contained SU privilege (when removing privilege)


 src/PVE/API2/Role.pm | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/PVE/API2/Role.pm b/src/PVE/API2/Role.pm
index 70a92b6..4a09ad6 100644
--- a/src/PVE/API2/Role.pm
+++ b/src/PVE/API2/Role.pm
@@ -4,6 +4,7 @@ use strict;
 use warnings;
 use PVE::Cluster qw (cfs_read_file cfs_write_file);
 use PVE::AccessControl;
+use PVE::Tools qw (split_list);
 use PVE::JSONSchema qw(get_standard_option register_standard_option);
 
 use PVE::SafeSyslog;
@@ -90,11 +91,19 @@ __PACKAGE__->register_method ({
 
 		my $usercfg = cfs_read_file("user.cfg");
 
+		my $rpcenv = PVE::RPCEnvironment::get();
+		my $authuser = $rpcenv->get_user();
+		my $is_superuser = $rpcenv->check($authuser, "/", ['SuperUser'], 1);
+
 		my $role = $param->{roleid};
 
 		die "role '$role' already exists\n"
 		    if $usercfg->{roles}->{$role};
 
+		my $contains_superuser = grep { $_ eq 'SuperUser' } split_list($param->{privs});
+		die "only superusers can add this privilege!\n"
+		    if $contains_superuser && !$is_superuser;
+
 		$usercfg->{roles}->{$role} = {};
 
 		PVE::AccessControl::add_role_privs($role, $usercfg, $param->{privs});
@@ -136,9 +145,21 @@ __PACKAGE__->register_method ({
 
 		my $usercfg = cfs_read_file("user.cfg");
 
+		my $rpcenv = PVE::RPCEnvironment::get();
+		my $authuser = $rpcenv->get_user();
+		my $is_superuser = $rpcenv->check($authuser, "/", ['SuperUser'], 1);
+
 		die "role '$role' does not exist\n"
 		    if !$usercfg->{roles}->{$role};
 
+		my @old_role_privs = keys(%{$usercfg->{roles}->{$role}});
+
+		my $contained_superuser = grep { $_ eq 'SuperUser' } @old_role_privs;
+		my $contains_superuser = grep { $_ eq 'SuperUser' } split_list($param->{privs});
+
+		die "only superusers can add/remove this privilege!\n"
+		    if ($contains_superuser || $contained_superuser) && !$is_superuser;
+
 		$usercfg->{roles}->{$role} = {} if !$param->{append};
 
 		PVE::AccessControl::add_role_privs($role, $usercfg, $param->{privs});
-- 
2.30.2