From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 79DFA1FF0B2 for ; Mon, 24 Aug 2026 13:26:28 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id B57B8215D0; Mon, 24 Aug 2026 13:26:24 +0200 (CEST) From: Elias Huhsovitz To: pve-devel@lists.proxmox.com Subject: [PATCH manager] fix #6735: api: pci: extend mdevscan persmissions for mappings Date: Mon, 24 Aug 2026 13:26:10 +0200 Message-ID: <20260824112610.148089-1-e.huhsovitz@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1787570749858 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.422 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_MAILER 2 Automated Mailer Tag Left in Email POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 5IHYYLQA66CVJHUIT5OIU543PPKZVQ3G X-Message-ID-Hash: 5IHYYLQA66CVJHUIT5OIU543PPKZVQ3G X-MailFrom: e.huhsovitz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Elias Huhsovitz X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The mdevscan endpoint currently requires Sys.Audit or Sys.Modify on the root path (/). This prevents non-admin users from querying available mediated device types for a PCI mapping, even if they have explicit Mapping.Use permissions on that specific mapping. Update the permission check to allow access if the user holds Mapping.Use, Mapping.Modify, or Mapping.Audit on the respective mapping path (i.e., /mapping/pci/{mapping}). This aligns the `GET /nodes/{node}/hardware/pci/{pci-id-or-mapping}/mdev` endpoint with the `GET /cluster/mapping/pci/{id}` endpoint. Signed-off-by: Elias Huhsovitz --- PVE/API2/Hardware/PCI.pm | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/PVE/API2/Hardware/PCI.pm b/PVE/API2/Hardware/PCI.pm index 36b9741b..de62bcd8 100644 --- a/PVE/API2/Hardware/PCI.pm +++ b/PVE/API2/Hardware/PCI.pm @@ -180,7 +180,18 @@ __PACKAGE__->register_method({ protected => 1, proxyto => "node", permissions => { - check => ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1], + description => "Requires 'Sys.Audit' or 'Sys.Modify' on '/' for PCI IDs," + . " or mapping permissions on the respective mapping.", + check => [ + 'or', + ['perm', '/', ['Sys.Audit', 'Sys.Modify'], any => 1], + [ + 'perm', + '/mapping/pci/{pci-id-or-mapping}', + ['Mapping.Use', 'Mapping.Modify', 'Mapping.Audit'], + any => 1, + ], + ], }, parameters => { additionalProperties => 0, -- 2.47.3