From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9])
by lore.proxmox.com (Postfix) with ESMTPS id 3BDAA1FF16E
for <inbox@lore.proxmox.com>; Mon, 17 Feb 2025 13:19:31 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 1A6B41ED69;
Mon, 17 Feb 2025 13:19:25 +0100 (CET)
From: Daniel Kral <d.kral@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Mon, 17 Feb 2025 13:19:15 +0100
Message-Id: <20250217121918.117810-1-d.kral@proxmox.com>
X-Mailer: git-send-email 2.39.5
MIME-Version: 1.0
X-SPAM-LEVEL: Spam detection results: 0
AWL 0.009 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
Subject: [pve-devel] [RFC manager 0/3] #fix 6094: relax permissions of
informational api endpoints
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: pve-devel-bounces@lists.proxmox.com
Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com>
Small patch series which relaxes the permissions needed for purely
informational API endpoints (i.e. do not modify system state, but only
read it) from "Sys.Modify" to accept any of "Sys.Modify" or "Sys.Audit".
The same has been done for other, similar API endpoints as well [0].
The initial bug report only included the API endpoint for fetching a
list of available updates on a node (GET `/nodes/{node}/apt/update`),
but it made sense to include other endpoints where this applies as well,
at least as an RFC.
This does preserve backwards compatibility for the
odd case where a user/token has only the "Sys.Modify" but not the
"Sys.Audit" permission on the previous paths.
As for the other commit [0], I didn't bother to adapt the WebGUI as
Resource Mappings, Updates and ACME are not accessible there now. If
there is more user interest to e.g. read the list of available updates
without being able to refresh or upgrade them, it should be an easy fix,
but should be done together with PMG (and possibly PBS) as those
components are defined in proxmox-widget-toolkit.
[0] https://git.proxmox.com/?p=pve-manager.git;a=commit;h=65cbfe79e49638c10acce4354182dcaeae96e74d
Daniel Kral (3):
fix #6094: api: apt: allow to get packages info with Sys.Audit
fix #6094: api: node HW: allow to get usb info with Sys.Audit on /
fix #6094: api: acme: allow to get plugin info with Sys.Audit on /
PVE/API2/ACMEPlugin.pm | 4 ++--
PVE/API2/APT.pm | 4 ++--
PVE/API2/Hardware/USB.pm | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel