From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id B405293370 for ; Mon, 19 Feb 2024 18:14:24 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 8C83B33787 for ; Mon, 19 Feb 2024 18:14:24 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Mon, 19 Feb 2024 18:14:22 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id A9DD943AAD for ; Mon, 19 Feb 2024 18:14:22 +0100 (CET) From: Thomas Lamprecht To: pve-devel@lists.proxmox.com Date: Mon, 19 Feb 2024 18:14:09 +0100 Message-Id: <20240219171412.1576651-2-t.lamprecht@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240219171412.1576651-1-t.lamprecht@proxmox.com> References: <20240219171412.1576651-1-t.lamprecht@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.057 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH access-control] add Sys.AccessNetwork privilege X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Feb 2024 17:14:24 -0000 We have some API endpoints that can access the network from the POV of a Proxmox VE node, like e.g., the one for downloading a template/ISO image directly to a PVE storage from an HTTP URL, and the matching query-url-metadata that makes this functionality much more convenient to use in the UI. But the downside of such calls is naturally that they basically allow to scan the whole network via HTTP URLs, and potentially even download some image that the user should not have access to and adding to a VM that the user controls. Due to that we limited the exposure of those API endpoints to Sys.Modify on / (in addition to e.g. basic storage privs) for the initial addition of the feature, as we were not sure about user adoption and if a separate privilege could be justified. Since we got a handful requests like #5254 this justification is now met, so add a 'Sys.AccessNetwork' privilege. That name should make it clear that having that privilege will allow access to the network and the sys(tem) prefix should underline that it's about the host systems network. Add it such, that it will only be available for the most powerful of our built-in special roles, namely the Administration one, besides naturally the all-powerful root@pam special user. Admins can then e.g. create new roles that include Sys.AccessNetwork and Datastore.AllocateTemplate which can then be used for allowing automation to download images while adhering to the Least Privilege Principle. Buglink: https://bugzilla.proxmox.com/show_bug.cgi?id=5254 Signed-off-by: Thomas Lamprecht --- src/PVE/AccessControl.pm | 1 + src/test/perm-test1.pl | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm index 25fc0d9..faea70d 100644 --- a/src/PVE/AccessControl.pm +++ b/src/PVE/AccessControl.pm @@ -1065,6 +1065,7 @@ my $privgroups = { 'Sys.PowerMgmt', 'Sys.Modify', # edit/change node settings 'Sys.Incoming', # incoming storage/guest migrations + 'Sys.AccessNetwork', # for, e.g., downloading ISOs from any URL ], admin => [ 'Sys.Console', diff --git a/src/test/perm-test1.pl b/src/test/perm-test1.pl index 27aadeb..df9fe90 100755 --- a/src/test/perm-test1.pl +++ b/src/test/perm-test1.pl @@ -79,7 +79,7 @@ check_permission( . 'Pool.Allocate,Pool.Audit,' . 'Realm.Allocate,Realm.AllocateUser,' . 'SDN.Allocate,SDN.Audit,SDN.Use,' - . 'Sys.Audit,Sys.Console,Sys.Incoming,Sys.Modify,Sys.PowerMgmt,Sys.Syslog,' + . 'Sys.AccessNetwork,Sys.Audit,Sys.Console,Sys.Incoming,Sys.Modify,Sys.PowerMgmt,Sys.Syslog,' . 'User.Modify,' . 'VM.Allocate,VM.Audit,VM.Backup,VM.Clone,VM.Config.CDROM,VM.Config.CPU,VM.Config.Cloudinit,' . 'VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,' -- 2.39.2