src/config/acl.rs

   1 use std::io::Write;
   2 use std::collections::{HashMap, BTreeMap, BTreeSet};
   3 use std::path::{PathBuf, Path};
   4 use std::sync::{Arc, RwLock};
   5 use std::str::FromStr;
   6
   7 use anyhow::{bail, Error};
   8
   9 use lazy_static::lazy_static;
  10
  11 use ::serde::{Deserialize, Serialize};
  12 use serde::de::{value, IntoDeserializer};
  13
  14 use proxmox::tools::{fs::replace_file, fs::CreateOptions};
  15 use proxmox::constnamedbitmap;
  16 use proxmox::api::{api, schema::*};
  17
  18 use crate::api2::types::{Authid,Userid};
  19
  20 // define Privilege bitfield
  21
  22 constnamedbitmap! {
  23     /// Contains a list of Privileges
  24     PRIVILEGES: u64 => {
  25         PRIV_SYS_AUDIT("Sys.Audit");
  26         PRIV_SYS_MODIFY("Sys.Modify");
  27         PRIV_SYS_POWER_MANAGEMENT("Sys.PowerManagement");
  28
  29         PRIV_DATASTORE_AUDIT("Datastore.Audit");
  30         PRIV_DATASTORE_ALLOCATE("Datastore.Allocate");
  31         PRIV_DATASTORE_MODIFY("Datastore.Modify");
  32         PRIV_DATASTORE_READ("Datastore.Read");
  33
  34         /// Datastore.Backup also requires backup ownership
  35         PRIV_DATASTORE_BACKUP("Datastore.Backup");
  36         /// Datastore.Prune also requires backup ownership
  37         PRIV_DATASTORE_PRUNE("Datastore.Prune");
  38
  39         PRIV_PERMISSIONS_MODIFY("Permissions.Modify");
  40
  41         PRIV_REMOTE_AUDIT("Remote.Audit");
  42         PRIV_REMOTE_MODIFY("Remote.Modify");
  43         PRIV_REMOTE_READ("Remote.Read");
  44         PRIV_REMOTE_PRUNE("Remote.Prune");
  45
  46         PRIV_SYS_CONSOLE("Sys.Console");
  47     }
  48 }
  49
  50
  51 /// Admin always has all privileges. It can do everything except a few actions
  52 /// which are limited to the 'root@pam` superuser
  53 pub const ROLE_ADMIN: u64 = std::u64::MAX;
  54
  55 /// NoAccess can be used to remove privileges from specific paths
  56 pub const ROLE_NO_ACCESS: u64 = 0;
  57
  58 pub const ROLE_AUDIT: u64 =
  59 PRIV_SYS_AUDIT |
  60 PRIV_DATASTORE_AUDIT;
  61
  62 /// Datastore.Admin can do anything on the datastore.
  63 pub const ROLE_DATASTORE_ADMIN: u64 =
  64 PRIV_DATASTORE_AUDIT |
  65 PRIV_DATASTORE_MODIFY |
  66 PRIV_DATASTORE_READ |
  67 PRIV_DATASTORE_BACKUP |
  68 PRIV_DATASTORE_PRUNE;
  69
  70 /// Datastore.Reader can read datastore content an do restore
  71 pub const ROLE_DATASTORE_READER: u64 =
  72 PRIV_DATASTORE_AUDIT |
  73 PRIV_DATASTORE_READ;
  74
  75 /// Datastore.Backup can do backup and restore, but no prune.
  76 pub const ROLE_DATASTORE_BACKUP: u64 =
  77 PRIV_DATASTORE_BACKUP;
  78
  79 /// Datastore.PowerUser can do backup, restore, and prune.
  80 pub const ROLE_DATASTORE_POWERUSER: u64 =
  81 PRIV_DATASTORE_PRUNE |
  82 PRIV_DATASTORE_BACKUP;
  83
  84 /// Datastore.Audit can audit the datastore.
  85 pub const ROLE_DATASTORE_AUDIT: u64 =
  86 PRIV_DATASTORE_AUDIT;
  87
  88 /// Remote.Audit can audit the remote
  89 pub const ROLE_REMOTE_AUDIT: u64 =
  90 PRIV_REMOTE_AUDIT;
  91
  92 /// Remote.Admin can do anything on the remote.
  93 pub const ROLE_REMOTE_ADMIN: u64 =
  94 PRIV_REMOTE_AUDIT |
  95 PRIV_REMOTE_MODIFY |
  96 PRIV_REMOTE_READ |
  97 PRIV_REMOTE_PRUNE;
  98
  99 /// Remote.SyncOperator can do read and prune on the remote.
 100 pub const ROLE_REMOTE_SYNC_OPERATOR: u64 =
 101 PRIV_REMOTE_AUDIT |
 102 PRIV_REMOTE_READ |
 103 PRIV_REMOTE_PRUNE;
 104
 105 pub const ROLE_NAME_NO_ACCESS: &str ="NoAccess";
 106
 107 #[api()]
 108 #[repr(u64)]
 109 #[derive(Serialize, Deserialize)]
 110 /// Role
 111 pub enum Role {
 112     /// Administrator
 113     Admin = ROLE_ADMIN,
 114     /// Auditor
 115     Audit = ROLE_AUDIT,
 116     /// Disable Access
 117     NoAccess = ROLE_NO_ACCESS,
 118     /// Datastore Administrator
 119     DatastoreAdmin = ROLE_DATASTORE_ADMIN,
 120     /// Datastore Reader (inspect datastore content and do restores)
 121     DatastoreReader = ROLE_DATASTORE_READER,
 122     /// Datastore Backup (backup and restore owned backups)
 123     DatastoreBackup = ROLE_DATASTORE_BACKUP,
 124     /// Datastore PowerUser (backup, restore and prune owned backup)
 125     DatastorePowerUser = ROLE_DATASTORE_POWERUSER,
 126     /// Datastore Auditor
 127     DatastoreAudit = ROLE_DATASTORE_AUDIT,
 128     /// Remote Auditor
 129     RemoteAudit = ROLE_REMOTE_AUDIT,
 130     /// Remote Administrator
 131     RemoteAdmin = ROLE_REMOTE_ADMIN,
 132     /// Syncronisation Opertator
 133     RemoteSyncOperator = ROLE_REMOTE_SYNC_OPERATOR,
 134 }
 135
 136 impl FromStr for Role {
 137     type Err = value::Error;
 138
 139     fn from_str(s: &str) -> Result<Self, Self::Err> {
 140         Self::deserialize(s.into_deserializer())
 141     }
 142 }
 143
 144 lazy_static! {
 145     pub static ref ROLE_NAMES: HashMap<&'static str, (u64, &'static str)> = {
 146         let mut map = HashMap::new();
 147
 148         let list = match Role::API_SCHEMA {
 149             Schema::String(StringSchema { format: Some(ApiStringFormat::Enum(list)), .. }) => list,
 150             _ => unreachable!(),
 151         };
 152
 153         for entry in list.iter() {
 154             let privs: u64 = Role::from_str(entry.value).unwrap() as u64;
 155             map.insert(entry.value, (privs, entry.description));
 156         }
 157
 158         map
 159     };
 160 }
 161
 162 pub fn split_acl_path(path: &str) -> Vec<&str> {
 163
 164     let items = path.split('/');
 165
 166     let mut components = vec![];
 167
 168     for name in items {
 169         if name.is_empty() { continue; }
 170         components.push(name);
 171     }
 172
 173     components
 174 }
 175
 176 pub fn check_acl_path(path: &str) -> Result<(), Error> {
 177
 178     let components = split_acl_path(path);
 179
 180     let components_len = components.len();
 181
 182     if components_len == 0 { return Ok(()); }
 183     match components[0] {
 184         "access" => {
 185             if components_len == 1 { return Ok(()); }
 186             match components[1] {
 187                 "acl" | "users" => {
 188                     if components_len == 2 { return Ok(()); }
 189                 }
 190                 _ => {},
 191             }
 192         }
 193         "datastore" => {  // /datastore/{store}
 194             if components_len <= 2 { return Ok(()); }
 195         }
 196         "remote" => { // /remote/{remote}/{store}
 197             if components_len <= 3 { return Ok(()); }
 198         }
 199         "system" => {
 200             if components_len == 1 { return Ok(()); }
 201             match components[1] {
 202                 "disks" | "log" | "status" | "tasks" | "time" => {
 203                     if components_len == 2 { return Ok(()); }
 204                 }
 205                 "services" => { // /system/services/{service}
 206                     if components_len <= 3 { return Ok(()); }
 207                 }
 208                 "network" => {
 209                     if components_len == 2 { return Ok(()); }
 210                     match components[2] {
 211                         "dns" => {
 212                             if components_len == 3 { return Ok(()); }
 213                         }
 214                         "interfaces" => { // /system/network/interfaces/{iface}
 215                             if components_len <= 4 { return Ok(()); }
 216                         }
 217                         _ => {}
 218                     }
 219                 }
 220                 _ => {}
 221             }
 222         }
 223         _ => {}
 224     }
 225
 226     bail!("invalid acl path '{}'.", path);
 227 }
 228
 229 pub struct AclTree {
 230     pub root: AclTreeNode,
 231 }
 232
 233 pub struct AclTreeNode {
 234     pub users: HashMap<Authid, HashMap<String, bool>>,
 235     pub groups: HashMap<String, HashMap<String, bool>>,
 236     pub children: BTreeMap<String, AclTreeNode>,
 237 }
 238
 239 impl AclTreeNode {
 240
 241     pub fn new() -> Self {
 242         Self {
 243             users: HashMap::new(),
 244             groups: HashMap::new(),
 245             children: BTreeMap::new(),
 246         }
 247     }
 248
 249     pub fn extract_roles(&self, auth_id: &Authid, all: bool) -> HashMap<String, bool> {
 250         let user_roles = self.extract_user_roles(auth_id, all);
 251         if !user_roles.is_empty() || auth_id.is_token() {
 252             // user privs always override group privs
 253             return user_roles
 254         };
 255
 256         self.extract_group_roles(auth_id.user(), all)
 257     }
 258
 259     pub fn extract_user_roles(&self, auth_id: &Authid, all: bool) -> HashMap<String, bool> {
 260
 261         let mut map = HashMap::new();
 262
 263         let roles = match self.users.get(auth_id) {
 264             Some(m) => m,
 265             None => return map,
 266         };
 267
 268         for (role, propagate) in roles {
 269             if *propagate || all {
 270                 if role == ROLE_NAME_NO_ACCESS {
 271                     // return a map with a single role 'NoAccess'
 272                     let mut map = HashMap::new();
 273                     map.insert(role.to_string(), false);
 274                     return map;
 275                 }
 276                 map.insert(role.to_string(), *propagate);
 277             }
 278         }
 279
 280         map
 281     }
 282
 283     pub fn extract_group_roles(&self, _user: &Userid, all: bool) -> HashMap<String, bool> {
 284
 285         let mut map = HashMap::new();
 286
 287         for (_group, roles) in &self.groups {
 288             let is_member = false; // fixme: check if user is member of the group
 289             if !is_member { continue; }
 290
 291             for (role, propagate) in roles {
 292                 if *propagate || all {
 293                     if role == ROLE_NAME_NO_ACCESS {
 294                         // return a map with a single role 'NoAccess'
 295                         let mut map = HashMap::new();
 296                         map.insert(role.to_string(), false);
 297                         return map;
 298                     }
 299                     map.insert(role.to_string(), *propagate);
 300                 }
 301             }
 302         }
 303
 304         map
 305     }
 306
 307     pub fn delete_group_role(&mut self, group: &str, role: &str) {
 308         let roles = match self.groups.get_mut(group) {
 309             Some(r) => r,
 310             None => return,
 311         };
 312         roles.remove(role);
 313     }
 314
 315     pub fn delete_user_role(&mut self, auth_id: &Authid, role: &str) {
 316         let roles = match self.users.get_mut(auth_id) {
 317             Some(r) => r,
 318             None => return,
 319         };
 320         roles.remove(role);
 321     }
 322
 323     pub fn insert_group_role(&mut self, group: String, role: String, propagate: bool) {
 324         let map = self.groups.entry(group).or_insert_with(|| HashMap::new());
 325         if role == ROLE_NAME_NO_ACCESS {
 326             map.clear();
 327             map.insert(role, propagate);
 328         } else {
 329             map.remove(ROLE_NAME_NO_ACCESS);
 330             map.insert(role, propagate);
 331         }
 332     }
 333
 334     pub fn insert_user_role(&mut self, auth_id: Authid, role: String, propagate: bool) {
 335         let map = self.users.entry(auth_id).or_insert_with(|| HashMap::new());
 336         if role == ROLE_NAME_NO_ACCESS {
 337             map.clear();
 338             map.insert(role, propagate);
 339         } else {
 340             map.remove(ROLE_NAME_NO_ACCESS);
 341             map.insert(role, propagate);
 342         }
 343     }
 344 }
 345
 346 impl AclTree {
 347
 348     pub fn new() -> Self {
 349         Self {
 350             root: AclTreeNode::new(),
 351         }
 352     }
 353
 354     pub fn find_node(&mut self, path: &str) -> Option<&mut AclTreeNode> {
 355         let path = split_acl_path(path);
 356         return self.get_node(&path);
 357     }
 358
 359     fn get_node(&mut self, path: &[&str]) -> Option<&mut AclTreeNode> {
 360         let mut node = &mut self.root;
 361         for comp in path {
 362             node = match node.children.get_mut(*comp) {
 363                 Some(n) => n,
 364                 None => return None,
 365             };
 366         }
 367         Some(node)
 368     }
 369
 370     fn get_or_insert_node(&mut self, path: &[&str]) -> &mut AclTreeNode {
 371         let mut node = &mut self.root;
 372         for comp in path {
 373             node = node.children.entry(String::from(*comp))
 374                 .or_insert_with(|| AclTreeNode::new());
 375         }
 376         node
 377     }
 378
 379     pub fn delete_group_role(&mut self, path: &str, group: &str, role: &str) {
 380         let path = split_acl_path(path);
 381         let node = match self.get_node(&path) {
 382             Some(n) => n,
 383             None => return,
 384         };
 385         node.delete_group_role(group, role);
 386     }
 387
 388     pub fn delete_user_role(&mut self, path: &str, auth_id: &Authid, role: &str) {
 389         let path = split_acl_path(path);
 390         let node = match self.get_node(&path) {
 391             Some(n) => n,
 392             None => return,
 393         };
 394         node.delete_user_role(auth_id, role);
 395     }
 396
 397     pub fn insert_group_role(&mut self, path: &str, group: &str, role: &str, propagate: bool) {
 398         let path = split_acl_path(path);
 399         let node = self.get_or_insert_node(&path);
 400         node.insert_group_role(group.to_string(), role.to_string(), propagate);
 401     }
 402
 403     pub fn insert_user_role(&mut self, path: &str, auth_id: &Authid, role: &str, propagate: bool) {
 404         let path = split_acl_path(path);
 405         let node = self.get_or_insert_node(&path);
 406         node.insert_user_role(auth_id.to_owned(), role.to_string(), propagate);
 407     }
 408
 409     fn write_node_config(
 410         node: &AclTreeNode,
 411         path: &str,
 412         w: &mut dyn Write,
 413     ) -> Result<(), Error> {
 414
 415         let mut role_ug_map0 = HashMap::new();
 416         let mut role_ug_map1 = HashMap::new();
 417
 418         for (auth_id, roles) in &node.users {
 419             // no need to save, because root is always 'Administrator'
 420             if !auth_id.is_token() && auth_id.user() == "root@pam" { continue; }
 421             for (role, propagate) in roles {
 422                 let role = role.as_str();
 423                 let auth_id = auth_id.to_string();
 424                 if *propagate {
 425                     role_ug_map1.entry(role).or_insert_with(|| BTreeSet::new())
 426                         .insert(auth_id);
 427                 } else {
 428                     role_ug_map0.entry(role).or_insert_with(|| BTreeSet::new())
 429                         .insert(auth_id);
 430                 }
 431             }
 432         }
 433
 434         for (group, roles) in &node.groups {
 435             for (role, propagate) in roles {
 436                 let group = format!("@{}", group);
 437                 if *propagate {
 438                     role_ug_map1.entry(role).or_insert_with(|| BTreeSet::new())
 439                         .insert(group);
 440                 } else {
 441                     role_ug_map0.entry(role).or_insert_with(|| BTreeSet::new())
 442                         .insert(group);
 443                 }
 444             }
 445         }
 446
 447         fn group_by_property_list(
 448             item_property_map: &HashMap<&str, BTreeSet<String>>,
 449         ) -> BTreeMap<String, BTreeSet<String>> {
 450             let mut result_map = BTreeMap::new();
 451             for (item, property_map) in item_property_map {
 452                 let item_list = property_map.iter().fold(String::new(), |mut acc, v| {
 453                     if !acc.is_empty() { acc.push(','); }
 454                     acc.push_str(v);
 455                     acc
 456                 });
 457                 result_map.entry(item_list).or_insert_with(|| BTreeSet::new())
 458                     .insert(item.to_string());
 459             }
 460             result_map
 461         }
 462
 463         let uglist_role_map0 = group_by_property_list(&role_ug_map0);
 464         let uglist_role_map1 = group_by_property_list(&role_ug_map1);
 465
 466         fn role_list(roles: &BTreeSet<String>) -> String {
 467             if roles.contains(ROLE_NAME_NO_ACCESS) { return String::from(ROLE_NAME_NO_ACCESS); }
 468             roles.iter().fold(String::new(), |mut acc, v| {
 469                 if !acc.is_empty() { acc.push(','); }
 470                 acc.push_str(v);
 471                 acc
 472             })
 473         }
 474
 475         for (uglist, roles) in &uglist_role_map0 {
 476             let role_list = role_list(roles);
 477             writeln!(w, "acl:0:{}:{}:{}", if path.is_empty() { "/" } else { path }, uglist, role_list)?;
 478         }
 479
 480         for (uglist, roles) in &uglist_role_map1 {
 481             let role_list = role_list(roles);
 482             writeln!(w, "acl:1:{}:{}:{}", if path.is_empty() { "/" } else { path }, uglist, role_list)?;
 483         }
 484
 485         for (name, child) in node.children.iter() {
 486             let child_path = format!("{}/{}", path, name);
 487             Self::write_node_config(child, &child_path, w)?;
 488         }
 489
 490         Ok(())
 491     }
 492
 493     pub fn write_config(&self, w: &mut dyn Write) -> Result<(), Error> {
 494         Self::write_node_config(&self.root, "", w)
 495     }
 496
 497     fn parse_acl_line(&mut self, line: &str) -> Result<(), Error> {
 498
 499         let items: Vec<&str> = line.split(':').collect();
 500
 501         if items.len() != 5 {
 502             bail!("wrong number of items.");
 503         }
 504
 505         if items[0] != "acl" {
 506             bail!("line does not start with 'acl'.");
 507         }
 508
 509         let propagate = if items[1] == "0" {
 510             false
 511         } else if items[1] == "1" {
 512             true
 513         } else {
 514             bail!("expected '0' or '1' for propagate flag.");
 515         };
 516
 517         let path_str = items[2];
 518         let path = split_acl_path(path_str);
 519         let node = self.get_or_insert_node(&path);
 520
 521         let uglist: Vec<&str> = items[3].split(',').map(|v| v.trim()).collect();
 522
 523         let rolelist: Vec<&str> = items[4].split(',').map(|v| v.trim()).collect();
 524
 525         for user_or_group in &uglist {
 526             for role in &rolelist {
 527                 if !ROLE_NAMES.contains_key(role) {
 528                     bail!("unknown role '{}'", role);
 529                 }
 530                 if user_or_group.starts_with('@') {
 531                     let group = &user_or_group[1..];
 532                     node.insert_group_role(group.to_string(), role.to_string(), propagate);
 533                 } else {
 534                     node.insert_user_role(user_or_group.parse()?, role.to_string(), propagate);
 535                 }
 536             }
 537         }
 538
 539         Ok(())
 540     }
 541
 542     pub fn load(filename: &Path) -> Result<(Self, [u8;32]), Error> {
 543         let mut tree = Self::new();
 544
 545         let raw = match std::fs::read_to_string(filename) {
 546             Ok(v) => v,
 547             Err(err) => {
 548                 if err.kind() == std::io::ErrorKind::NotFound {
 549                     String::new()
 550                 } else {
 551                     bail!("unable to read acl config {:?} - {}", filename, err);
 552                 }
 553             }
 554         };
 555
 556         let digest = openssl::sha::sha256(raw.as_bytes());
 557
 558         for (linenr, line) in raw.lines().enumerate() {
 559             let line = line.trim();
 560             if line.is_empty() { continue; }
 561             if let Err(err) = tree.parse_acl_line(line) {
 562                 bail!("unable to parse acl config {:?}, line {} - {}",
 563                       filename, linenr+1, err);
 564             }
 565         }
 566
 567         Ok((tree, digest))
 568     }
 569
 570     pub fn from_raw(raw: &str) -> Result<Self, Error> {
 571         let mut tree = Self::new();
 572         for (linenr, line) in raw.lines().enumerate() {
 573             let line = line.trim();
 574             if line.is_empty() { continue; }
 575             if let Err(err) = tree.parse_acl_line(line) {
 576                 bail!("unable to parse acl config data, line {} - {}", linenr+1, err);
 577             }
 578         }
 579         Ok(tree)
 580     }
 581
 582     pub fn roles(&self, auth_id: &Authid, path: &[&str]) -> HashMap<String, bool> {
 583
 584         let mut node = &self.root;
 585         let mut role_map = node.extract_roles(auth_id, path.is_empty());
 586
 587         for (pos, comp) in path.iter().enumerate() {
 588             let last_comp = (pos + 1) == path.len();
 589             node = match node.children.get(*comp) {
 590                 Some(n) => n,
 591                 None => return role_map, // path not found
 592             };
 593
 594             let new_map = node.extract_roles(auth_id, last_comp);
 595             if !new_map.is_empty() {
 596                 // overwrite previous maptings
 597                 role_map = new_map;
 598             }
 599         }
 600
 601         role_map
 602     }
 603 }
 604
 605 pub const ACL_CFG_FILENAME: &str = "/etc/proxmox-backup/acl.cfg";
 606 pub const ACL_CFG_LOCKFILE: &str = "/etc/proxmox-backup/.acl.lck";
 607
 608 pub fn config() -> Result<(AclTree, [u8; 32]), Error> {
 609     let path = PathBuf::from(ACL_CFG_FILENAME);
 610     AclTree::load(&path)
 611 }
 612
 613 pub fn cached_config() -> Result<Arc<AclTree>, Error> {
 614
 615     struct ConfigCache {
 616         data: Option<Arc<AclTree>>,
 617         last_mtime: i64,
 618         last_mtime_nsec: i64,
 619     }
 620
 621     lazy_static! {
 622         static ref CACHED_CONFIG: RwLock<ConfigCache> = RwLock::new(
 623             ConfigCache { data: None, last_mtime: 0, last_mtime_nsec: 0 });
 624     }
 625
 626     let stat = match nix::sys::stat::stat(ACL_CFG_FILENAME) {
 627         Ok(stat) => Some(stat),
 628         Err(nix::Error::Sys(nix::errno::Errno::ENOENT)) => None,
 629         Err(err) => bail!("unable to stat '{}' - {}", ACL_CFG_FILENAME, err),
 630     };
 631
 632     { // limit scope
 633         let cache = CACHED_CONFIG.read().unwrap();
 634         if let Some(ref config) = cache.data {
 635             if let Some(stat) = stat {
 636                 if stat.st_mtime == cache.last_mtime && stat.st_mtime_nsec == cache.last_mtime_nsec {
 637                     return Ok(config.clone());
 638                 }
 639             } else if cache.last_mtime == 0 && cache.last_mtime_nsec == 0 {
 640                 return Ok(config.clone());
 641             }
 642         }
 643     }
 644
 645     let (config, _digest) = config()?;
 646     let config = Arc::new(config);
 647
 648     let mut cache = CACHED_CONFIG.write().unwrap();
 649     if let Some(stat) = stat {
 650         cache.last_mtime = stat.st_mtime;
 651         cache.last_mtime_nsec = stat.st_mtime_nsec;
 652     }
 653     cache.data = Some(config.clone());
 654
 655     Ok(config)
 656 }
 657
 658 pub fn save_config(acl: &AclTree) -> Result<(), Error> {
 659     let mut raw: Vec<u8> = Vec::new();
 660
 661     acl.write_config(&mut raw)?;
 662
 663     let backup_user = crate::backup::backup_user()?;
 664     let mode = nix::sys::stat::Mode::from_bits_truncate(0o0640);
 665     // set the correct owner/group/permissions while saving file
 666     // owner(rw) = root, group(r)= backup
 667     let options = CreateOptions::new()
 668         .perm(mode)
 669         .owner(nix::unistd::ROOT)
 670         .group(backup_user.gid);
 671
 672     replace_file(ACL_CFG_FILENAME, &raw, options)?;
 673
 674     Ok(())
 675 }
 676
 677 #[cfg(test)]
 678 mod test {
 679     use anyhow::{Error};
 680     use super::AclTree;
 681
 682     use crate::api2::types::Authid;
 683
 684     fn check_roles(
 685         tree: &AclTree,
 686         auth_id: &Authid,
 687         path: &str,
 688         expected_roles: &str,
 689     ) {
 690
 691         let path_vec = super::split_acl_path(path);
 692         let mut roles = tree.roles(auth_id, &path_vec)
 693             .iter().map(|(v, _)| v.clone()).collect::<Vec<String>>();
 694         roles.sort();
 695         let roles = roles.join(",");
 696
 697         assert_eq!(roles, expected_roles, "\nat check_roles for '{}' on '{}'", auth_id, path);
 698     }
 699
 700     #[test]
 701     fn test_acl_line_compression() {
 702
 703         let tree = AclTree::from_raw(
 704             "\
 705             acl:0:/store/store2:user1@pbs:Admin\n\
 706             acl:0:/store/store2:user2@pbs:Admin\n\
 707             acl:0:/store/store2:user1@pbs:DatastoreBackup\n\
 708             acl:0:/store/store2:user2@pbs:DatastoreBackup\n\
 709             ",
 710         )
 711         .expect("failed to parse acl tree");
 712
 713         let mut raw: Vec<u8> = Vec::new();
 714         tree.write_config(&mut raw).expect("failed to write acl tree");
 715         let raw = std::str::from_utf8(&raw).expect("acl tree is not valid utf8");
 716
 717         assert_eq!(raw, "acl:0:/store/store2:user1@pbs,user2@pbs:Admin,DatastoreBackup\n");
 718     }
 719
 720     #[test]
 721     fn test_roles_1() -> Result<(), Error> {
 722
 723         let tree = AclTree::from_raw(r###"
 724 acl:1:/storage:user1@pbs:Admin
 725 acl:1:/storage/store1:user1@pbs:DatastoreBackup
 726 acl:1:/storage/store2:user2@pbs:DatastoreBackup
 727 "###)?;
 728         let user1: Authid = "user1@pbs".parse()?;
 729         check_roles(&tree, &user1, "/", "");
 730         check_roles(&tree, &user1, "/storage", "Admin");
 731         check_roles(&tree, &user1, "/storage/store1", "DatastoreBackup");
 732         check_roles(&tree, &user1, "/storage/store2", "Admin");
 733
 734         let user2: Authid = "user2@pbs".parse()?;
 735         check_roles(&tree, &user2, "/", "");
 736         check_roles(&tree, &user2, "/storage", "");
 737         check_roles(&tree, &user2, "/storage/store1", "");
 738         check_roles(&tree, &user2, "/storage/store2", "DatastoreBackup");
 739
 740         Ok(())
 741     }
 742
 743     #[test]
 744     fn test_role_no_access() -> Result<(), Error> {
 745
 746         let tree = AclTree::from_raw(r###"
 747 acl:1:/:user1@pbs:Admin
 748 acl:1:/storage:user1@pbs:NoAccess
 749 acl:1:/storage/store1:user1@pbs:DatastoreBackup
 750 "###)?;
 751         let user1: Authid = "user1@pbs".parse()?;
 752         check_roles(&tree, &user1, "/", "Admin");
 753         check_roles(&tree, &user1, "/storage", "NoAccess");
 754         check_roles(&tree, &user1, "/storage/store1", "DatastoreBackup");
 755         check_roles(&tree, &user1, "/storage/store2", "NoAccess");
 756         check_roles(&tree, &user1, "/system", "Admin");
 757
 758         let tree = AclTree::from_raw(r###"
 759 acl:1:/:user1@pbs:Admin
 760 acl:0:/storage:user1@pbs:NoAccess
 761 acl:1:/storage/store1:user1@pbs:DatastoreBackup
 762 "###)?;
 763         check_roles(&tree, &user1, "/", "Admin");
 764         check_roles(&tree, &user1, "/storage", "NoAccess");
 765         check_roles(&tree, &user1, "/storage/store1", "DatastoreBackup");
 766         check_roles(&tree, &user1, "/storage/store2", "Admin");
 767         check_roles(&tree, &user1, "/system", "Admin");
 768
 769         Ok(())
 770     }
 771
 772     #[test]
 773     fn test_role_add_delete() -> Result<(), Error> {
 774
 775         let mut tree = AclTree::new();
 776
 777         let user1: Authid = "user1@pbs".parse()?;
 778
 779         tree.insert_user_role("/", &user1, "Admin", true);
 780         tree.insert_user_role("/", &user1, "Audit", true);
 781
 782         check_roles(&tree, &user1, "/", "Admin,Audit");
 783
 784         tree.insert_user_role("/", &user1, "NoAccess", true);
 785         check_roles(&tree, &user1, "/", "NoAccess");
 786
 787         let mut raw: Vec<u8> = Vec::new();
 788         tree.write_config(&mut raw)?;
 789         let raw = std::str::from_utf8(&raw)?;
 790
 791         assert_eq!(raw, "acl:1:/:user1@pbs:NoAccess\n");
 792
 793         Ok(())
 794     }
 795
 796     #[test]
 797     fn test_no_access_overwrite() -> Result<(), Error> {
 798
 799         let mut tree = AclTree::new();
 800
 801         let user1: Authid = "user1@pbs".parse()?;
 802
 803         tree.insert_user_role("/storage", &user1, "NoAccess", true);
 804
 805         check_roles(&tree, &user1, "/storage", "NoAccess");
 806
 807         tree.insert_user_role("/storage", &user1, "Admin", true);
 808         tree.insert_user_role("/storage", &user1, "Audit", true);
 809
 810         check_roles(&tree, &user1, "/storage", "Admin,Audit");
 811
 812         tree.insert_user_role("/storage", &user1, "NoAccess", true);
 813
 814         check_roles(&tree, &user1, "/storage", "NoAccess");
 815
 816         Ok(())
 817     }
 818 }