From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 10D801FF0E9 for ; Thu, 16 Jul 2026 12:43:47 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id D440921419; Thu, 16 Jul 2026 12:43:46 +0200 (CEST) From: David Riley To: pve-devel@lists.proxmox.com Subject: [PATCH pve-access-control v6 1/8] permission: add acl tree node parent lookup without node creation Date: Thu, 16 Jul 2026 12:42:40 +0200 Message-ID: <20260716104247.29047-2-d.riley@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260716104247.29047-1-d.riley@proxmox.com> References: <20260716104247.29047-1-d.riley@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784198574523 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.173 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: VYUDV5SLXY5RWQAZBI36CBGXEIFJ7SFA X-Message-ID-Hash: VYUDV5SLXY5RWQAZBI36CBGXEIFJ7SFA X-MailFrom: d.riley@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Add helper function to look up ACL nodes by path without creating missing nodes along the path. This is necessary for safely locating paths intended for deletion or migration without side effects. This is in preparation for the following SDN resource ACL pruning and VNet migration changes. Signed-off-by: David Riley Reviewed-by: Stefan Hanreich Tested-by: Stefan Hanreich --- Notes: Difference from v5: * The comment for find_acl_tree_node_parent now uses the POD format. src/PVE/AccessControl.pm | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm index 0d632b3..a47495e 100644 --- a/src/PVE/AccessControl.pm +++ b/src/PVE/AccessControl.pm @@ -1000,6 +1000,37 @@ sub find_acl_tree_node { return $node; } +=head3 find_acl_tree_node_parent($root, $path) + +Finds an ACL node by path C<$path> starting from the root node +C<$root>, without autovivifying (creating) missing nodes. +Returns a list containing the parent node, the final path +segment, and the target node itself. + +=cut + +sub find_acl_tree_node_parent { + my ($root, $path) = @_; + + my $current = $root; + my $parent = undef; + my $last_key = undef; + + my @split_path = split('/', $path); + + for my $segment (@split_path) { + if (defined($current->{children}) && defined($current->{children}->{$segment})) { + $parent = $current; + $last_key = $segment; + $current = $current->{children}->{$segment}; + } else { + return (undef, undef, undef); + } + } + + return ($parent, $last_key, $current); +} + sub add_user_group { my ($username, $usercfg, $group) = @_; -- 2.47.3