From: Aaron Lauterer <a.lauterer@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>,
Dominik Csapak <d.csapak@proxmox.com>
Subject: Re: [pve-devel] [PATCH qemu-server v7 1/1] api: update: check 'admin' tags privileges
Date: Wed, 14 Sep 2022 16:15:21 +0200 [thread overview]
Message-ID: <8856001e-0872-2032-3d60-2408845ffcda@proxmox.com> (raw)
In-Reply-To: <20220621092012.1776825-10-d.csapak@proxmox.com>
Something that crossed my mind:
Have you thought about not allowing tags if they match an admin tag, except for
the '+'?
Depending on what they will be used for in the future, there could be some
potential to trick an admin by creating a similar regular tag. Any code relying
on admin tags should not have an issue with that, but even though the color in
the GUI should be different, one could try to trick an admin to do something
they should not, depending on the tags.
Visual spoofing with similar looking UTF8 characters should not be much of an
issue, due to the regex used.
On 6/21/22 11:19, Dominik Csapak wrote:
> normal tags require 'VM.Config.Options' on the VM, admin tags require
> 'Sys.Modify' on '/'
>
> a user can set/delete/reorder tags, as long as no admin tags get
> added/removed
>
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
[...]
next prev parent reply other threads:[~2022-09-14 14:15 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-21 9:19 [pve-devel] [PATCH common/cluster/qemu/container/wt/manager v7] add tags to ui Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH common v7 1/2] JSONSchema: refactor tag regex Dominik Csapak
2022-09-20 11:37 ` [pve-devel] applied: " Thomas Lamprecht
2022-06-21 9:19 ` [pve-devel] [PATCH common v7 2/2] JSONSchema: pve-tag: add syntax for 'admin' tags Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH cluster v7 1/3] add CFS_IPC_GET_GUEST_CONFIG_PROPERTIES method Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH cluster v7 2/3] Cluster: add get_guest_config_properties Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH cluster v7 3/3] datacenter.cfg: add option for tag-style Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH widget-toolkit v7 1/3] add tag related helpers Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:19 ` [pve-devel] [PATCH widget-toolkit v7 2/3] add class for 'admin' tags Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH widget-toolkit v7 3/3] Toolkit: add override for Ext.dd.DragDropManager Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH qemu-server v7 1/1] api: update: check 'admin' tags privileges Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer [this message]
2022-09-15 11:46 ` Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH container v7 1/1] check_ct_modify_config_perm: " Dominik Csapak
2022-06-21 9:19 ` [pve-devel] [PATCH manager v7 01/14] api: /cluster/resources: add tags to returned properties Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 02/14] api: /version: add 'tag-style' Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 03/14] ui: parse and save tag color overrides from /version Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 04/14] ui: tree/ResourceTree: collect tags on update Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 05/14] ui: add form/TagColorGrid Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 06/14] ui: dc/OptionView: add editors for tag settings Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 07/14] ui: add form/Tag Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-09-14 14:36 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 08/14] ui: add form/TagEdit.js Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 09/14] ui: {lxc, qemu}/Config: show Tags and make them editable Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 10/14] ui: tree/ResourceTree: show Tags in tree Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-09-15 11:54 ` Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 11/14] ui: form/GlobalSearchField: display tags and allow to search for them Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 12/14] ui: form/Tag: add 'admin-tag' class to admin tags Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 13/14] ui: ResourceGrid: render tags Dominik Csapak
2022-06-21 9:20 ` [pve-devel] [PATCH manager v7 14/14] ui: form/Tag(Edit): add drag & drop when editing tags Dominik Csapak
2022-09-14 14:15 ` Aaron Lauterer
2022-09-15 11:56 ` Dominik Csapak
2022-09-14 14:34 ` [pve-devel] [PATCH common/cluster/qemu/container/wt/manager v7] add tags to ui Aaron Lauterer
2022-09-16 7:19 ` Thomas Lamprecht
2022-09-16 7:50 ` Dominik Csapak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8856001e-0872-2032-3d60-2408845ffcda@proxmox.com \
--to=a.lauterer@proxmox.com \
--cc=d.csapak@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox