src/config/acl.rs: introduce more/better datastore privileges

[proxmox-backup.git] / src / config / acl.rs

diff --git a/src/config/acl.rs b/src/config/acl.rs
index adf1b9a60827f411da7fb9029196bd6a00fd6763..2cae1c741a6610e464c7210019e1c0ddbc5bc958 100644 (file)
--- a/src/config/acl.rs
+++ b/src/config/acl.rs
@@ -3,7 +3,7 @@ use std::collections::{HashMap, HashSet, BTreeMap, BTreeSet};
 use std::path::{PathBuf, Path};
 use std::sync::{Arc, RwLock};
 
-use failure::*;
+use anyhow::{bail, Error};
 
 use lazy_static::lazy_static;
 
@@ -16,10 +16,12 @@ pub const PRIV_SYS_MODIFY: u64                   = 1 << 1;
 pub const PRIV_SYS_POWER_MANAGEMENT: u64         = 1 << 2;
 
 pub const PRIV_DATASTORE_AUDIT: u64              = 1 << 3;
-pub const PRIV_DATASTORE_ALLOCATE: u64           = 1 << 4;
-pub const PRIV_DATASTORE_ALLOCATE_SPACE: u64     = 1 << 5;
+pub const PRIV_DATASTORE_MODIFY: u64             = 1 << 4;
+pub const PRIV_DATASTORE_CREATE_BACKUP: u64      = 1 << 5;
+pub const PRIV_DATASTORE_READ: u64               = 1 << 6;
+pub const PRIV_DATASTORE_PRUNE: u64              = 1 << 7;
 
-pub const PRIV_PERMISSIONS_MODIFY: u64           = 1 << 6;
+pub const PRIV_PERMISSIONS_MODIFY: u64           = 1 << 8;
 
 pub const ROLE_ADMIN: u64 = std::u64::MAX;
 pub const ROLE_NO_ACCESS: u64 = 0;
@@ -30,14 +32,17 @@ PRIV_DATASTORE_AUDIT;
 
 pub const ROLE_DATASTORE_ADMIN: u64 =
 PRIV_DATASTORE_AUDIT |
-PRIV_DATASTORE_ALLOCATE |
-PRIV_DATASTORE_ALLOCATE_SPACE;
+PRIV_DATASTORE_MODIFY |
+PRIV_DATASTORE_CREATE_BACKUP |
+PRIV_DATASTORE_READ |
+PRIV_DATASTORE_PRUNE;
 
 pub const ROLE_DATASTORE_USER: u64 =
-PRIV_DATASTORE_AUDIT |
-PRIV_DATASTORE_ALLOCATE_SPACE;
+PRIV_DATASTORE_CREATE_BACKUP;
+
+pub const ROLE_DATASTORE_AUDIT: u64 =
+PRIV_DATASTORE_AUDIT;
 
-pub const ROLE_DATASTORE_AUDIT: u64 = PRIV_DATASTORE_AUDIT;
 pub const ROLE_NAME_NO_ACCESS: &str ="NoAccess";
 
 lazy_static! {
@@ -520,7 +525,7 @@ pub fn save_config(acl: &AclTree) -> Result<(), Error> {
 #[cfg(test)]
 mod test {
 
-    use failure::*;
+    use anyhow::{Error};
     use super::AclTree;
 
     fn check_roles(