[pve-devel] [PATCH qemu-server v4 4/9] refactor: check_mapping_access: move root user check to the top

[Filip Schauer <f.schauer@proxmox.com>]

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
---
 PVE/QemuServer.pm | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 70518924..6c842924 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -6378,12 +6378,14 @@ sub check_bridge_access {
 sub check_mapping_access {
     my ($rpcenv, $user, $conf) = @_;
 
+    return 1 if $user eq 'root@pam';
+
     for my $opt (keys $conf->%*) {
 	if ($opt =~ m/^usb\d+$/) {
 	    my $device = PVE::JSONSchema::parse_property_string('pve-qm-usb', $conf->{$opt});
 	    if (my $host = $device->{host}) {
 		die "only root can set '$opt' config for real devices\n"
-		    if $host !~ m/^spice$/i && $user ne 'root@pam';
+		    if $host !~ m/^spice$/i;
 	    } elsif ($device->{mapping}) {
 		$rpcenv->check_full($user, "/mapping/usb/$device->{mapping}", ['Mapping.Use']);
 	    } else {
@@ -6392,7 +6394,7 @@ sub check_mapping_access {
 	} elsif ($opt =~ m/^hostpci\d+$/) {
 	    my $device = PVE::JSONSchema::parse_property_string('pve-qm-hostpci', $conf->{$opt});
 	    if ($device->{host}) {
-		die "only root can set '$opt' config for non-mapped devices\n" if $user ne 'root@pam';
+		die "only root can set '$opt' config for non-mapped devices\n";
 	    } elsif ($device->{mapping}) {
 		$rpcenv->check_full($user, "/mapping/pci/$device->{mapping}", ['Mapping.Use']);
 	    } else {
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel