[pve-devel] [PATCH container v7 1/1] check_ct_modify_config_perm: check 'admin' tags privileges

[Dominik Csapak <d.csapak@proxmox.com>]

normal tags require 'VM.Config.Options' on the CT, admin tags require
'Sys.Modify' on '/'

a user can set/delete/reorder tags, as long as no admin tags get
added/removed

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 src/PVE/LXC.pm        | 31 +++++++++++++++++++++++++++++++
 src/PVE/LXC/Config.pm |  3 ++-
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index fe63087..ce2f8ff 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1333,6 +1333,37 @@ sub check_ct_modify_config_perm {
 	} elsif ($opt eq 'hookscript') {
 	    # For now this is restricted to root@pam
 	    raise_perm_exc("changing the hookscript is only allowed for root\@pam");
+	} elsif ($opt eq 'tags') {
+	    my $old_tags = {};
+	    my $new_tags = {};
+	    my $check_admin = 0;
+	    my $check_user = 0;
+
+	    map { $old_tags->{$_} = 1 } PVE::Tools::split_list($oldconf->{$opt});
+	    map { $new_tags->{$_} = 1 } PVE::Tools::split_list($newconf->{$opt});
+
+	    my $check_tags = sub {
+		my ($a, $b) = @_;
+		foreach my $tag (keys %$a) {
+		    next if $b->{$tag};
+		    if (PVE::JSONSchema::is_admin_pve_tag($tag)) {
+			$check_admin = 1;
+		    } else {
+			$check_user = 1;
+		    }
+		}
+	    };
+
+	    $check_tags->($old_tags, $new_tags);
+	    $check_tags->($new_tags, $old_tags);
+
+	    if ($check_admin) {
+		$rpcenv->check($authuser, "/", ['Sys.Modify']);
+	    }
+
+	    if ($check_user) {
+		$rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
+	    }
 	} else {
 	    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 	}
diff --git a/src/PVE/LXC/Config.pm b/src/PVE/LXC/Config.pm
index b4b0261..2362d74 100644
--- a/src/PVE/LXC/Config.pm
+++ b/src/PVE/LXC/Config.pm
@@ -597,7 +597,8 @@ my $confdesc = {
     },
     tags => {
 	type => 'string', format => 'pve-tag-list',
-	description => 'Tags of the Container. This is only meta information.',
+	description => 'Tags of the Container. This is only meta information. Prefixing a tag with'.
+	    "'+' marks it as an admin tag and can only be set with 'Sys.Modify' on '/'.",
 	optional => 1,
     },
     debug => {
-- 
2.30.2