fix bug #379: allow to overwrite existing CTs if user has VM.Backup permissions

The requirement to have VM.Allocate it non-obvious and confusing
if the VM already exists. If the user can backup, he should also be able
to restore that backup.

diff --git a/PVE/API2/OpenVZ.pm b/PVE/API2/OpenVZ.pm
index d6d5c6fb95ce7c2dfa64add7b5ef1f946ad3c222..11b4a9dcfa02759d7ed77a937f348bb0dbdd547d 100644 (file)
--- a/PVE/API2/OpenVZ.pm
+++ b/PVE/API2/OpenVZ.pm
@@ -232,11 +232,10 @@ __PACKAGE__->register_method({
     method => 'POST',
     description => "Create or restore a container.",
     permissions => {
-       description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}, and 'Datastore.AllocateSpace' on the storage.",
-       check => [ 'or', 
-                  [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
-                  [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
-           ],
+       user => 'all', # check inside
+       description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
+           "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
+           "You also need 'Datastore.AllocateSpace' permissions on the storage.",
     },
     protected => 1,
     proxyto => 'node',
@@ -306,6 +305,8 @@ __PACKAGE__->register_method({
 
        my $private = PVE::Storage::get_private_dir($storage_cfg, $storage, $vmid);
 
+       my $basecfg_fn = PVE::OpenVZ::config_file($vmid);
+
        if (defined($pool)) {
            $rpcenv->check_pool_exist($pool);
            $rpcenv->check_perm_modify($authuser, "/pool/$pool");
@@ -313,6 +314,17 @@ __PACKAGE__->register_method({
 
        $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace']);
 
+       if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
+           # OK
+       } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
+           # OK
+       } elsif ($param->{restore} && $param->{force} && (-f $basecfg_fn) &&
+                $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
+           # OK: user has VM.Backup permissions, and want to restore an existing VM
+       } else {
+           raise_perm_exc();
+       }
+
        &$check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 
        PVE::Storage::activate_storage($storage_cfg, $storage);
@@ -356,8 +368,6 @@ __PACKAGE__->register_method({
            $param->{hostname} .= ".$param->{searchdomain}";
        }
 
-       my $basecfg_fn = PVE::OpenVZ::config_file($vmid);
-
        my $check_vmid_usage = sub {
            if ($param->{force}) {
                die "cant overwrite mounted container\n"