From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 82A7F9AFD8 for ; Mon, 20 Nov 2023 08:22:53 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 6B3A2148AA for ; Mon, 20 Nov 2023 08:22:53 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Mon, 20 Nov 2023 08:22:52 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 37A90432F0 for ; Mon, 20 Nov 2023 08:22:52 +0100 (CET) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pve-devel@lists.proxmox.com Date: Mon, 20 Nov 2023 08:22:39 +0100 Message-Id: <20231120072242.75599-2-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231120072242.75599-1-f.gruenbichler@proxmox.com> References: <20231120072242.75599-1-f.gruenbichler@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.065 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH access-control 1/2] fix #1148: allow up to three levels of pool nesting X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Nov 2023 07:22:53 -0000 with ACLs being inherited along the pool hierarchy. Signed-off-by: Fabian Grünbichler --- Notes: v1: encode max pool nesting in REs src/PVE/AccessControl.pm | 10 ++++++++-- src/test/perm-test6.pl | 16 ++++++++++++++++ src/test/test6.cfg | 5 +++++ 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm index 9600e59..4e3b077 100644 --- a/src/PVE/AccessControl.pm +++ b/src/PVE/AccessControl.pm @@ -1264,7 +1264,7 @@ sub check_path { |/nodes |/nodes/[[:alnum:]\.\-\_]+ |/pool - |/pool/[[:alnum:]\.\-\_]+ + |/pool/[A-Za-z0-9\.\-_]+(?:/[A-Za-z0-9\.\-_]+){0,2} |/sdn |/sdn/controllers |/sdn/controllers/[[:alnum:]\_\-]+ @@ -1318,8 +1318,14 @@ PVE::JSONSchema::register_format('pve-poolid', \&verify_poolname); sub verify_poolname { my ($poolname, $noerr) = @_; - if ($poolname !~ m/^[A-Za-z0-9\.\-_]+$/) { + if (split("/", $poolname) > 3) { + die "pool name '$poolname' nested too deeply (max levels = 3)\n" if !$noerr; + return undef; + } + + # also adapt check_path above if changed! + if ($poolname !~ m!^[A-Za-z0-9\.\-_]+(?:/[A-Za-z0-9\.\-_]+){0,2}$!) { die "pool name '$poolname' contains invalid characters\n" if !$noerr; return undef; diff --git a/src/test/perm-test6.pl b/src/test/perm-test6.pl index 0b0d036..c2d40fc 100755 --- a/src/test/perm-test6.pl +++ b/src/test/perm-test6.pl @@ -75,6 +75,22 @@ check_roles('User4@pve', '/vms/500', ''); # with pool check_permissions('User4@pve', '/vms/500', ''); +# without pool, checking no access on parent pool +check_roles('intern@pve', '/vms/600', ''); +# once more, with VM in nested pool +check_roles('intern@pve', '/vms/700', ''); +# with propagated ACL +check_roles('User4@pve', '/vms/700', ''); +# with pool, checking no access on parent pool +check_permissions('intern@pve', '/vms/600', ''); +# once more, with VM in nested pool +check_permissions('intern@pve', '/vms/700', 'VM.Audit'); +# with propagated ACL +check_permissions('User4@pve', '/vms/700', 'VM.Console'); + +# check nested pool permissions +check_roles('intern@pve', '/pool/marketing/interns', 'RoleINTERN'); +check_roles('User4@pve', '/pool/marketing/interns', 'RoleMARKETING'); check_permissions('User1@pve', '/vms/600', 'VM.Console'); check_permissions('User2@pve', '/vms/600', 'VM.Console'); diff --git a/src/test/test6.cfg b/src/test/test6.cfg index 4986910..661f56a 100644 --- a/src/test/test6.cfg +++ b/src/test/test6.cfg @@ -2,16 +2,20 @@ user:User1@pve:1: user:User2@pve:1: user:User3@pve:1: user:User4@pve:1: +user:intern@pve:1: group:DEVEL:User1@pve,User2@pve,User3@pve: group:MARKETING:User1@pve,User4@pve: +group:INTERNS:intern@pve: role:RoleDEVEL:VM.PowerMgmt: role:RoleMARKETING:VM.Console: +role:RoleINTERN:VM.Audit: role:RoleTEST1:VM.Console: acl:1:/pool/devel:@DEVEL:RoleDEVEL: acl:1:/pool/marketing:@MARKETING:RoleMARKETING: +acl:1:/pool/marketing/interns:@INTERNS:RoleINTERN: acl:1:/vms:@DEVEL:RoleTEST1: acl:1:/vms:User3@pve:NoAccess: @@ -19,3 +23,4 @@ acl:1:/vms/300:@MARKETING:RoleTEST1: pool:devel:MITS development:500,501,502:store1 store2: pool:marketing:MITS marketing:600:store1: +pool:marketing/interns:MITS marketing intern:700:store3: -- 2.39.2