From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH access-control 0/3] fix two propagation related bugs
Date: Fri, 3 Jun 2022 13:50:46 +0200 [thread overview]
Message-ID: <20220603115049.1908792-1-f.gruenbichler@proxmox.com> (raw)
these patches fix two related bugs:
- the propagation flag used for priv dumping was set randomly if two
roles with a common priv exist on a path, one with and one without
propagation
- user/token priv intersection only took user privs into account that
had propagation set
the first can affect the second one negatively (if the first bug causes
the propagation flag to be dropped, the second one will drop the priv
from the merged set of privileges for priv-separated tokens).
in both cases there is no possibility to elevate privileges:
- bug #1 sometimes marks privs as non-propagated that are, but only for
display, not for checking purposes
- bug #2 causes a token to have less privileges than it should, not more
Fabian Grünbichler (3):
permissions: properly merge propagation flag
permissions: fix token/user priv intersection
permissions: add some more comments
src/PVE/RPCEnvironment.pm | 44 +++++++++++++++++++++++++++++++++++----
src/test/perm-test8.pl | 2 +-
src/test/test8.cfg | 2 ++
3 files changed, 43 insertions(+), 5 deletions(-)
--
2.30.2
next reply other threads:[~2022-06-03 11:51 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-03 11:50 Fabian Grünbichler [this message]
2022-06-03 11:50 ` [pve-devel] [PATCH access-control 1/3] permissions: properly merge propagation flag Fabian Grünbichler
2022-06-03 11:50 ` [pve-devel] [PATCH access-control 2/3] permissions: fix token/user priv intersection Fabian Grünbichler
2022-06-03 11:50 ` [pve-devel] [PATCH access-control 3/3] permissions: add some more comments Fabian Grünbichler
2022-06-03 12:03 ` [pve-devel] applied series: [PATCH access-control 0/3] fix two propagation related bugs Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220603115049.1908792-1-f.gruenbichler@proxmox.com \
--to=f.gruenbichler@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox