From: Dominik Csapak <d.csapak@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH qemu-server v7 1/1] api: update: check 'admin' tags privileges
Date: Tue, 21 Jun 2022 11:19:57 +0200 [thread overview]
Message-ID: <20220621092012.1776825-10-d.csapak@proxmox.com> (raw)
In-Reply-To: <20220621092012.1776825-1-d.csapak@proxmox.com>
normal tags require 'VM.Config.Options' on the VM, admin tags require
'Sys.Modify' on '/'
a user can set/delete/reorder tags, as long as no admin tags get
added/removed
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
PVE/API2/Qemu.pm | 56 ++++++++++++++++++++++++++++++++++++++++++++++-
PVE/QemuServer.pm | 3 ++-
2 files changed, 57 insertions(+), 2 deletions(-)
diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 99b426e..37b56c8 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -519,7 +519,6 @@ my $generaloptions = {
'startup' => 1,
'tdf' => 1,
'template' => 1,
- 'tags' => 1,
};
my $vmpoweroptions = {
@@ -589,6 +588,7 @@ my $check_vm_modify_config_perm = sub {
next if PVE::QemuServer::is_valid_drivename($opt);
next if $opt eq 'cdrom';
next if $opt =~ m/^(?:unused|serial|usb)\d+$/;
+ next if $opt eq 'tags';
if ($cpuoptions->{$opt} || $opt =~ m/^numa\d+$/) {
@@ -1559,6 +1559,27 @@ my $update_vm_api = sub {
}
PVE::QemuConfig->add_to_pending_delete($conf, $opt, $force);
PVE::QemuConfig->write_config($vmid, $conf);
+ } elsif ($opt eq 'tags') {
+ my $check_admin = 0;
+ my $check_options = 0;
+ foreach my $tag (PVE::Tools::split_list($val)) {
+ if (PVE::JSONSchema::is_admin_pve_tag($tag)) {
+ $check_admin = 1;
+ } else {
+ $check_options = 1;
+ }
+ }
+
+ if ($check_admin) {
+ $rpcenv->check($authuser, "/", ['Sys.Modify']);
+ }
+
+ if ($check_options) {
+ $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Options']);
+ }
+
+ delete $conf->{$opt};
+ PVE::QemuConfig->write_config($vmid, $conf);
} else {
PVE::QemuConfig->add_to_pending_delete($conf, $opt, $force);
PVE::QemuConfig->write_config($vmid, $conf);
@@ -1619,6 +1640,39 @@ my $update_vm_api = sub {
die "only root can modify '$opt' config for real devices\n";
}
$conf->{pending}->{$opt} = $param->{$opt};
+ } elsif ($opt eq 'tags') {
+ my $check_admin = 0;
+ my $check_user = 0;
+
+ my $old_tags = {};
+ my $new_tags = {};
+
+ map { $old_tags->{$_} = 1 } PVE::Tools::split_list($conf->{$opt});
+ map { $new_tags->{$_} = 1 } PVE::Tools::split_list($param->{$opt});
+
+ my $check_tags = sub {
+ my ($a, $b) = @_;
+ foreach my $tag (keys %$a) {
+ next if $b->{$tag};
+ if (PVE::JSONSchema::is_admin_pve_tag($tag)) {
+ $check_admin = 1;
+ } else {
+ $check_user = 1;
+ }
+ }
+ };
+
+ $check_tags->($old_tags, $new_tags);
+ $check_tags->($new_tags, $old_tags);
+
+ if ($check_admin) {
+ $rpcenv->check($authuser, "/", ['VM.Config.Options']);
+ }
+
+ if ($check_user) {
+ $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Options']);
+ }
+ $conf->{pending}->{$opt} = $param->{$opt};
} else {
$conf->{pending}->{$opt} = $param->{$opt};
diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index b3964bc..48247cc 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -698,7 +698,8 @@ EODESCR
},
tags => {
type => 'string', format => 'pve-tag-list',
- description => 'Tags of the VM. This is only meta information.',
+ description => 'Tags of the VM. This is only meta information. Prefixing a tag with'.
+ "'+' marks it as an admin tag and can only be set with 'Sys.Modify' on '/'.",
optional => 1,
},
rng0 => {
--
2.30.2
next prev parent reply other threads:[~2022-06-21 9:20 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-21 9:19 [pve-devel] [PATCH common/cluster/qemu/container/wt/manager v7] add tags to ui Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH common v7 1/2] JSONSchema: refactor tag regex Dominik Csapak
2022-09-20 11:37 ` [pve-devel] applied: " Thomas Lamprecht
2022-06-21 9:19 ` [pve-devel] [PATCH common v7 2/2] JSONSchema: pve-tag: add syntax for 'admin' tags Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH cluster v7 1/3] add CFS_IPC_GET_GUEST_CONFIG_PROPERTIES method Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH cluster v7 2/3] Cluster: add get_guest_config_properties Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH cluster v7 3/3] datacenter.cfg: add option for tag-style Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH widget-toolkit v7 1/3] add tag related helpers Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:19 ` [pve-devel] [PATCH widget-toolkit v7 2/3] add class for 'admin' tags Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH widget-toolkit v7 3/3] Toolkit: add override for Ext.dd.DragDropManager Dominik Csapak
2022-06-21 9:19 ` Dominik Csapak [this message]
2022-09-14 14:15 ` [pve-devel] [PATCH qemu-server v7 1/1] api: update: check 'admin' tags privileges Aaron Lauterer
2022-09-15 11:46 ` Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH container v7 1/1] check_ct_modify_config_perm: " Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH manager v7 01/14] api: /cluster/resources: add tags to returned properties Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 02/14] api: /version: add 'tag-style' Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 03/14] ui: parse and save tag color overrides from /version Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 04/14] ui: tree/ResourceTree: collect tags on update Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 05/14] ui: add form/TagColorGrid Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 06/14] ui: dc/OptionView: add editors for tag settings Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 07/14] ui: add form/Tag Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-09-14 14:36 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 08/14] ui: add form/TagEdit.js Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 09/14] ui: {lxc, qemu}/Config: show Tags and make them editable Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 10/14] ui: tree/ResourceTree: show Tags in tree Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-09-15 11:54 ` Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 11/14] ui: form/GlobalSearchField: display tags and allow to search for them Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 12/14] ui: form/Tag: add 'admin-tag' class to admin tags Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 13/14] ui: ResourceGrid: render tags Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 14/14] ui: form/Tag(Edit): add drag & drop when editing tags Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-09-15 11:56 ` Dominik Csapak
2022-09-14 14:34 ` [pve-devel] [PATCH common/cluster/qemu/container/wt/manager v7] add tags to ui Aaron Lauterer
2022-09-16 7:19 ` Thomas Lamprecht
2022-09-16 7:50 ` Dominik Csapak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220621092012.1776825-10-d.csapak@proxmox.com \
--to=d.csapak@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox