From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 859111FF0A5 for ; Fri, 04 Sep 2026 11:45:18 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id EEE9F215FE; Fri, 04 Sep 2026 11:45:03 +0200 (CEST) From: Elias Huhsovitz To: pve-devel@lists.proxmox.com Subject: [PATCH manager v4 0/2] fix #6735: api: pci: allow mdevscan access via mapping permissions Date: Fri, 4 Sep 2026 11:44:52 +0200 Message-ID: <20260904094456.70309-1-e.huhsovitz@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1788515095393 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.664 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 5NVKMURSXN7AAWARVKG7EXYCVH5WUG7D X-Message-ID-Hash: 5NVKMURSXN7AAWARVKG7EXYCVH5WUG7D X-MailFrom: e.huhsovitz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Elias Huhsovitz X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This series allows users who have been granted Mapping.Use (or Mapping.Modify / Mapping.Audit) on a specific PCI mapping to list the mediated device (mdev) types for that mapping without requiring global Sys.Audit or Sys.Modify privileges on the entire cluster. In multi‑team environments where access is compartmentalized via resource pools and PCI mappings, the previous requirement forced administrators to grant overly broad permissions for GPU usage. By checking mapping‑specific permissions when a mapping name is supplied, the patch enables non‑administrative users to select and use vGPU types for their assigned hardware. Patch 1/2 makes the necessary logical change for fixing #6735. Patch 2/2 utilizes a new constant parameter for the `pci_scan` endpoint Changes v3->v4 -------------- * factor out global permissions into constant * de-rerence global permissions array when passing it to `raise_perm_exc` * add optional second patch to utilize global permissions constant for `pci_scan` endpoint Changes v2->v3 -------------- * re-introduce else-statement in API handler * move permissions checks into respective logical branches (previously sepate sesection before core code) * update commit message Changes v1->v2 -------------- * Allow all users in the declarative API permissions. * Implement ACL check in API handler by calling check_any and raise_perm_exc. * Remove else statement in API handler, since return statement provides implicit branching * update commit message Previous Versions ----------------- v3: https://lore.proxmox.com/pve-devel/20260903121143.145841-1-e.huhsovitz@proxmox.com/ v2: https://lore.proxmox.com/pve-devel/20260827112525.154445-1-e.huhsovitz@proxmox.com/ v1: https://lore.proxmox.com/pve-devel/20260824112610.148089-1-e.huhsovitz@proxmox.com/ Summary of Changes ------------------ Elias Huhsovitz (2): fix #6735: api: pci: allow mdevscan access via mapping permissions api: pci: utilize constant perm variable for pci_scan PVE/API2/Hardware/PCI.pm | 47 ++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 12 deletions(-) -- 2.47.3