From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 811A68E6A for ; Wed, 16 Nov 2022 18:35:24 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 667322360B for ; Wed, 16 Nov 2022 18:34:54 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 16 Nov 2022 18:34:53 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 64E4344D82 for ; Wed, 16 Nov 2022 18:34:53 +0100 (CET) From: Leo Nunner To: pve-devel@lists.proxmox.com Date: Wed, 16 Nov 2022 18:34:29 +0100 Message-Id: <20221116173430.257506-3-l.nunner@proxmox.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221116173430.257506-1-l.nunner@proxmox.com> References: <20221116173430.257506-1-l.nunner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: =?UTF-8?Q?0=0A=09?=AWL -0.094 Adjusted score from AWL reputation of From: =?UTF-8?Q?address=0A=09?=BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict =?UTF-8?Q?Alignment=0A=09?=SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF =?UTF-8?Q?Record=0A=09?=SPF_PASS -0.001 SPF: sender matches SPF =?UTF-8?Q?record=0A=09?=URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [qemu.pm, drive.pm] Subject: [pve-devel] [PATCH v2 qemu-server 1/1] fix #4321: properly check cloud-init drive permissions X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Nov 2022 17:35:24 -0000 The process for editing Cloud-init drives checked for inconsistent permissions: for adding, the VM.Config.Disk permission was needed, while the VM.Config.CDROM permission was needed to remove a drive. The regex in drive_is_cloudinit needed to be adapted since the drive names have different formats before/after they are actually generated. Due to the regex letting names fall through before, Cloud-init drives were being checked as disks, even though they are actually treated as CDROM drives. Due to this, it makes more sense to check for VM.Config.CDROM instead, while also requiring VM.Config.Cloudinit, since generating a Cloud-init drive already generates default values that are passed to the VM. Signed-off-by: Leo Nunner --- PVE/API2/Qemu.pm | 6 ++++-- PVE/QemuServer/Drive.pm | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm index 30348e6..7453ecb 100644 --- a/PVE/API2/Qemu.pm +++ b/PVE/API2/Qemu.pm @@ -1623,11 +1623,13 @@ my $update_vm_api = sub { my $check_drive_perms = sub { my ($opt, $val) = @_; my $drive = PVE::QemuServer::parse_drive($opt, $val, 1); - # FIXME: cloudinit: CDROM or Disk? - if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM + if (PVE::QemuServer::drive_is_cloudinit($drive)) { + $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Cloudinit', 'VM.Config.CDROM']); + } elsif (PVE::QemuServer::drive_is_cdrom($drive, 1)) { # CDROM $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']); } else { $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']); + } }; diff --git a/PVE/QemuServer/Drive.pm b/PVE/QemuServer/Drive.pm index 1dc6171..12a1fbe 100644 --- a/PVE/QemuServer/Drive.pm +++ b/PVE/QemuServer/Drive.pm @@ -540,7 +540,7 @@ sub verify_bootdisk { sub drive_is_cloudinit { my ($drive) = @_; - return $drive->{file} =~ m@[:/]vm-\d+-cloudinit(?:\.$QEMU_FORMAT_RE)?$@; + return $drive->{file} =~ m@[:/](?:vm-\d+-)?cloudinit(?:\.$QEMU_FORMAT_RE)?$@; } sub drive_is_cdrom { -- 2.30.2