1 package PVE::API2::ACL;
5 use PVE::Cluster qw (cfs_read_file cfs_write_file);
6 use PVE::Tools qw(split_list);
7 use PVE::AccessControl;
8 use PVE::Exception qw(raise_param_exc);
12 use Data::Dumper; # fixme: remove
16 use base qw(PVE::RESTHandler);
18 __PACKAGE__->register_method ({
22 description => "Get Access Control List (ACLs).",
24 additionalProperties => 0,
31 additionalProperties => 0,
33 path => { type => 'string' },
34 type => { type => 'string', enum => ['user', 'group'] },
35 ugid => { type => 'string' },
36 roleid => { type => 'string' },
37 propagate => { type => 'boolean' },
46 my $usercfg = cfs_read_file("user.cfg");
48 if (!$usercfg || !$usercfg->{acl}) {
52 my $acl = $usercfg->{acl};
53 foreach my $path (keys %$acl) {
54 foreach my $type (qw(users groups)) {
55 my $d = $acl->{$path}->{$type};
57 foreach my $id (keys %$d) {
58 foreach my $role (keys %{$d->{$id}}) {
59 my $propagate = $d->{$id}->{$role};
62 type => $type eq 'groups' ? 'group' : 'user',
65 propagate => $propagate,
75 __PACKAGE__->register_method ({
80 description => "Update Access Control List (add or remove permissions).",
82 additionalProperties => 0,
85 description => "Access control path",
89 description => "List of users.",
90 type => 'string', format => 'pve-userid-list',
94 description => "List of groups.",
95 type => 'string', format => 'pve-groupid-list',
99 description => "List of roles.",
100 type => 'string', format => 'pve-roleid-list',
103 description => "Allow to propagate (inherit) permissions.",
108 description => "Remove permissions (instead of adding it).",
114 returns => { type => 'null' },
118 if (!($param->{users} || $param->{groups})) {
120 users => "either 'users' or 'groups' is required.",
121 groups => "either 'users' or 'groups' is required." });
124 my $path = PVE::AccessControl::normalize_path($param->{path});
125 raise_param_exc({ path => "invalid ACL path '$param->{path}'" }) if !$path;
127 PVE::AccessControl::lock_user_config(
130 my $cfg = cfs_read_file("user.cfg");
132 my $propagate = $param->{propagate} ? 1 : 0;
134 foreach my $role (split_list($param->{roles})) {
135 die "role '$role' does not exist\n"
136 if !$cfg->{roles}->{$role};
138 foreach my $group (split_list($param->{groups})) {
140 die "group '$group' does not exist\n"
141 if !$cfg->{groups}->{$group};
143 if ($param->{delete}) {
144 delete($cfg->{acl}->{$path}->{groups}->{$group}->{$role});
146 $cfg->{acl}->{$path}->{groups}->{$group}->{$role} = $propagate;
150 foreach my $userid (split_list($param->{users})) {
151 my $username = PVE::AccessControl::verify_username($userid);
153 die "user '$username' does not exist\n"
154 if !$cfg->{users}->{$username};
156 if ($param->{delete}) {
157 delete($cfg->{acl}->{$path}->{users}->{$username}->{$role});
159 $cfg->{acl}->{$path}->{users}->{$username}->{$role} = $propagate;
164 cfs_write_file("user.cfg", $cfg);
165 }, "ACL update failed");