public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Daniel Kral <d.kral@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [RFC manager 1/3] fix #6094: api: apt: allow to get packages info with Sys.Audit
Date: Mon, 17 Feb 2025 13:19:16 +0100	[thread overview]
Message-ID: <20250217121918.117810-2-d.kral@proxmox.com> (raw)
In-Reply-To: <20250217121918.117810-1-d.kral@proxmox.com>

Relax the required permissions to query the current list of available
package updates and the changelog of a package on a node. Both API
endpoints do not modify any system state except caching outputs.

Those were probably only "Sys.Modify" before, since both are used in
conjunction with upgrading packages in the WebGUI, which is only visible
with that permission, but some users might be interested in this
information outside of this and/or without being able to upgrade.

Keep Sys.Modify for backwards compatibility.

Signed-off-by: Daniel Kral <d.kral@proxmox.com>
---
 PVE/API2/APT.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/PVE/API2/APT.pm b/PVE/API2/APT.pm
index 47c50961..2a1de1e6 100644
--- a/PVE/API2/APT.pm
+++ b/PVE/API2/APT.pm
@@ -202,7 +202,7 @@ __PACKAGE__->register_method({
     method => 'GET',
     description => "List available updates.",
     permissions => {
-	check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
+	check => ['perm', '/nodes/{node}', [ 'Sys.Audit', 'Sys.Modify' ], any => 1],
     },
     protected => 1,
     proxyto => 'node',
@@ -379,7 +379,7 @@ __PACKAGE__->register_method({
     method => 'GET',
     description => "Get package changelogs.",
     permissions => {
-	check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
+	check => ['perm', '/nodes/{node}', [ 'Sys.Audit', 'Sys.Modify' ], any => 1],
     },
     proxyto => 'node',
     parameters => {
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel


  reply	other threads:[~2025-02-17 12:19 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-17 12:19 [pve-devel] [RFC manager 0/3] #fix 6094: relax permissions of informational api endpoints Daniel Kral
2025-02-17 12:19 ` Daniel Kral [this message]
2025-05-06 13:52   ` [pve-devel] [RFC manager 1/3] fix #6094: api: apt: allow to get packages info with Sys.Audit Fiona Ebner
2025-02-17 12:19 ` [pve-devel] [RFC manager 2/3] fix #6094: api: node HW: allow to get usb info with Sys.Audit on / Daniel Kral
2025-05-06 13:52   ` Fiona Ebner
2025-02-17 12:19 ` [pve-devel] [RFC manager 3/3] fix #6094: api: acme: allow to get plugin " Daniel Kral
2025-05-06 13:52   ` Fiona Ebner
2025-05-07  9:15     ` Fabian Grünbichler
2025-05-07  9:43       ` Daniel Kral

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250217121918.117810-2-d.kral@proxmox.com \
    --to=d.kral@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal