From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 2C95C9EE1C for ; Wed, 7 Jun 2023 14:05:00 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 0E7CF1954D for ; Wed, 7 Jun 2023 14:04:30 +0200 (CEST) Received: from bastionodiso.odiso.net (bastionodiso.odiso.net [185.151.191.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 7 Jun 2023 14:04:29 +0200 (CEST) Received: from kvmformation3.odiso.net (formationkvm3.odiso.net [10.3.94.12]) by bastionodiso.odiso.net (Postfix) with ESMTP id 10D988B65; Wed, 7 Jun 2023 14:04:29 +0200 (CEST) Received: by kvmformation3.odiso.net (Postfix, from userid 0) id F00782B61ED; Wed, 7 Jun 2023 14:03:58 +0200 (CEST) From: Alexandre Derumier To: pve-devel@lists.proxmox.com Date: Wed, 7 Jun 2023 14:03:47 +0200 Message-Id: <20230607120357.4177891-1-aderumier@odiso.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.115 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy HEADER_FROM_DIFFERENT_DOMAINS 0.25 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jun 2023 12:05:00 -0000 add vnet/localbridge permissions management Hi, as we has discuted some weeks ago, this patche serie introduce management of acl for vnets && local bridges The permission path is: /sdn/zones// where the local vmbr are in a virtual "localnetwork" zone /sdn/zones/localnetwork/ Vlans permissions are also handled with /sdn/zones/// if user have permissions on the vnet/tag, he have access to only the specific vlan. if user have permissions on the vnet with propagate, he have access to all vlans of the vnet if user have permissions on the vnet without propagate, he have access to bridge only without any vlan I have reworked the sdn zone panel from the tree, to manage permissions on displayed vnets. (patch 3 && 4 pve-manager) some screenshots: https://mutulin1.odiso.net/sdnzone-perm.png https://mutulin1.odiso.net/localzone-perm.png changelog v2: - use /vnets/vlan instead /vnets.vlan - rework the bridge filtering when user have access only to a specific vlan - api2 network: always check bridge access if no filter is defined changelog v3: - use /sdn/zones//vnets/vlan instead /sdn/vnets/vnets.vlan - add SDN.Use permission - pve-manager: split ui code (could be applied later) - remove check on zone (it's now propagate with new path) - move check_vnet_access to pve-guest-common for lxc reuse - pve-network: fix vnet/tag perm check changelog v4: - qemu-server: check permissions on backup restore - guest-common: check trunks permissions todo: - implement lxc check permissions pve-access-control: Alexandre Derumier (3): access control: add /sdn/zones/// path rpcenvironnment: add check_sdn_bridge add new SDN.use privilege in PVESDNUser role src/PVE/AccessControl.pm | 6 +++++- src/PVE/RPCEnvironment.pm | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) pve-manager: Alexandre Derumier (4): api2: network: check permissions for local bridges api2: cluster: ressources: add "localnetwork" zone ui: add vnet permissions panel ui: add permissions management for "localnetwork" zone PVE/API2/Cluster.pm | 14 ++ PVE/API2/Network.pm | 25 ++- www/manager6/Makefile | 2 + www/manager6/sdn/Browser.js | 17 +- www/manager6/sdn/VnetACLView.js | 289 +++++++++++++++++++++++++++ www/manager6/sdn/ZoneContentPanel.js | 41 ++++ www/manager6/sdn/ZoneContentView.js | 52 ++++- 7 files changed, 411 insertions(+), 29 deletions(-) create mode 100644 www/manager6/sdn/VnetACLView.js create mode 100644 www/manager6/sdn/ZoneContentPanel.js pve-guest-common: Alexandre Derumier (1): helpers : add check_vnet_access src/PVE/GuestHelpers.pm | 49 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) qemu-server: Alexandre Derumier (1): api2: add check_bridge_access for create/update/clone/restore vm PVE/API2/Qemu.pm | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) pve-network: Alexandre Derumier (1): get_local_vnets: fix permission path && perm PVE/Network/SDN.pm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.30.2