PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::RESTEnvironment;
   7
   8 use PVE::Exception qw(raise raise_perm_exc);
   9 use PVE::SafeSyslog;
  10 use PVE::Tools;
  11 use PVE::INotify;
  12 use PVE::Cluster;
  13 use PVE::ProcFSTools;
  14 use PVE::AccessControl;
  15
  16 use base qw(PVE::RESTEnvironment);
  17
  18 # ACL cache
  19
  20 my $compile_acl_path = sub {
  21     my ($self, $user, $path) = @_;
  22
  23     my $cfg = $self->{user_cfg};
  24
  25     return undef if !$cfg->{roles};
  26
  27     die "internal error" if $user eq 'root@pam';
  28
  29     my $cache = $self->{aclcache};
  30     $cache->{$user} = {} if !$cache->{$user};
  31     my $data = $cache->{$user};
  32
  33     if (!$data->{poolroles}) {
  34         $data->{poolroles} = {};
  35
  36         foreach my $pool (keys %{$cfg->{pools}}) {
  37             my $d = $cfg->{pools}->{$pool};
  38             my @ra = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  39             next if !scalar(@ra);
  40             foreach my $vmid (keys %{$d->{vms}}) {
  41                 for my $role (@ra) {
  42                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  43                 }
  44             }
  45             foreach my $storeid (keys %{$d->{storage}}) {
  46                 for my $role (@ra) {
  47                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  48                 }
  49             }
  50         }
  51     }
  52
  53     my @ra = PVE::AccessControl::roles($cfg, $user, $path);
  54
  55     # apply roles inherited from pools
  56     # Note: assume we do not want to propagate those privs
  57     if ($data->{poolroles}->{$path}) {
  58         if (!($ra[0] && $ra[0] eq 'NoAccess')) {
  59             if ($data->{poolroles}->{$path}->{NoAccess}) {
  60                 @ra = ('NoAccess');
  61             } else {
  62                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  63                     push @ra, $role;
  64                 }
  65             }
  66         }
  67     }
  68
  69     $data->{roles}->{$path} = [ @ra ];
  70
  71     my $privs = {};
  72     foreach my $role (@ra) {
  73         if (my $privset = $cfg->{roles}->{$role}) {
  74             foreach my $p (keys %$privset) {
  75                 $privs->{$p} = 1;
  76             }
  77         }
  78     }
  79     $data->{privs}->{$path} = $privs;
  80
  81     return $privs;
  82 };
  83
  84 sub roles {
  85    my ($self, $user, $path) = @_;
  86
  87    if ($user eq 'root@pam') { # root can do anything
  88        return ('Administrator');
  89    }
  90
  91    $user = PVE::AccessControl::verify_username($user, 1);
  92    return () if !$user;
  93
  94    my $cache = $self->{aclcache};
  95    $cache->{$user} = {} if !$cache->{$user};
  96
  97    my $acl = $cache->{$user};
  98
  99    my $roles = $acl->{roles}->{$path};
 100    return @$roles if $roles;
 101
 102    &$compile_acl_path($self, $user, $path);
 103    $roles = $acl->{roles}->{$path} || [];
 104    return @$roles;
 105 }
 106
 107 sub permissions {
 108     my ($self, $user, $path) = @_;
 109
 110     if ($user eq 'root@pam') { # root can do anything
 111         my $cfg = $self->{user_cfg};
 112         return $cfg->{roles}->{'Administrator'};
 113     }
 114
 115     $user = PVE::AccessControl::verify_username($user, 1);
 116     return {} if !$user;
 117
 118     my $cache = $self->{aclcache};
 119     $cache->{$user} = {} if !$cache->{$user};
 120
 121     my $acl = $cache->{$user};
 122
 123     my $perm = $acl->{privs}->{$path};
 124     return $perm if $perm;
 125
 126     return &$compile_acl_path($self, $user, $path);
 127 }
 128
 129 sub check {
 130     my ($self, $user, $path, $privs, $noerr) = @_;
 131
 132     my $perm = $self->permissions($user, $path);
 133
 134     foreach my $priv (@$privs) {
 135         PVE::AccessControl::verify_privname($priv);
 136         if (!$perm->{$priv}) {
 137             return undef if $noerr;
 138             raise_perm_exc("$path, $priv");
 139         }
 140     };
 141
 142     return 1;
 143 };
 144
 145 sub check_any {
 146     my ($self, $user, $path, $privs, $noerr) = @_;
 147
 148     my $perm = $self->permissions($user, $path);
 149
 150     my $found = 0;
 151     foreach my $priv (@$privs) {
 152         PVE::AccessControl::verify_privname($priv);
 153         if ($perm->{$priv}) {
 154             $found = 1;
 155             last;
 156         }
 157     };
 158
 159     return 1 if $found;
 160
 161     return undef if $noerr;
 162
 163     raise_perm_exc("$path, " . join("|", @$privs));
 164 };
 165
 166 sub check_full {
 167     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 168     if ($any) {
 169         return $self->check_any($username, $path, $privs, $noerr);
 170     } else {
 171         return $self->check($username, $path, $privs, $noerr);
 172     }
 173 }
 174
 175 sub check_user_enabled {
 176     my ($self, $user, $noerr) = @_;
 177
 178     my $cfg = $self->{user_cfg};
 179     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 180 }
 181
 182 sub check_user_exist {
 183     my ($self, $user, $noerr) = @_;
 184
 185     my $cfg = $self->{user_cfg};
 186     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 187 }
 188
 189 sub check_pool_exist {
 190     my ($self, $pool, $noerr) = @_;
 191
 192     my $cfg = $self->{user_cfg};
 193
 194     return 1 if $cfg->{pools}->{$pool};
 195
 196     return undef if $noerr;
 197
 198     raise_perm_exc("pool '$pool' does not exist");
 199 }
 200
 201 sub check_vm_perm {
 202     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 203
 204     my $cfg = $self->{user_cfg};
 205
 206     if ($pool) {
 207         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 208     }
 209     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 210 };
 211
 212 sub is_group_member {
 213     my ($self, $group, $user) = @_;
 214
 215     my $cfg = $self->{user_cfg};
 216
 217     return 0 if !$cfg->{groups}->{$group};
 218
 219     return defined($cfg->{groups}->{$group}->{users}->{$user});
 220 }
 221
 222 sub filter_groups {
 223     my ($self, $user, $privs, $any) = @_;
 224
 225     my $cfg = $self->{user_cfg};
 226
 227     my $groups = {};
 228     foreach my $group (keys %{$cfg->{groups}}) {
 229         my $path = "/access/groups/$group";
 230         if ($self->check_full($user, $path, $privs, $any, 1)) {
 231             $groups->{$group} = $cfg->{groups}->{$group};
 232         }
 233     }
 234
 235     return $groups;
 236 }
 237
 238 sub group_member_join {
 239     my ($self, $grouplist) = @_;
 240
 241     my $users = {};
 242
 243     my $cfg = $self->{user_cfg};
 244     foreach my $group (@$grouplist) {
 245         my $data = $cfg->{groups}->{$group};
 246         next if !$data;
 247         foreach my $user (keys %{$data->{users}}) {
 248             $users->{$user} = 1;
 249         }
 250     }
 251
 252     return $users;
 253 }
 254
 255 sub check_perm_modify {
 256     my ($self, $username, $path, $noerr) = @_;
 257
 258     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 259
 260     my $testperms = [ 'Permissions.Modify' ];
 261     if ($path =~ m|^/storage/.+$|) {
 262         push @$testperms, 'Datastore.Allocate';
 263     } elsif ($path =~ m|^/vms/.+$|) {
 264         push @$testperms, 'VM.Allocate';
 265     } elsif ($path =~ m|^/pool/.+$|) {
 266         push @$testperms, 'Pool.Allocate';
 267     }
 268
 269     return $self->check_any($username, $path, $testperms, $noerr);
 270 }
 271
 272 sub exec_api2_perm_check {
 273     my ($self, $check, $username, $param, $noerr) = @_;
 274
 275     # syslog("info", "CHECK " . join(', ', @$check));
 276
 277     my $ind = 0;
 278     my $test = $check->[$ind++];
 279     die "no permission test specified" if !$test;
 280
 281     if ($test eq 'and') {
 282         while (my $subcheck = $check->[$ind++]) {
 283             $self->exec_api2_perm_check($subcheck, $username, $param);
 284         }
 285         return 1;
 286     } elsif ($test eq 'or') {
 287         while (my $subcheck = $check->[$ind++]) {
 288             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 289         }
 290         return 0 if $noerr;
 291         raise_perm_exc();
 292     } elsif ($test eq 'perm') {
 293         my ($t, $tmplpath, $privs, %options) = @$check;
 294         my $any = $options{any};
 295         die "missing parameters" if !($tmplpath && $privs);
 296         my $require_param = $options{require_param};
 297         if ($require_param && !defined($param->{$require_param})) {
 298             return 0 if $noerr;
 299             raise_perm_exc();
 300         }
 301         my $path = PVE::Tools::template_replace($tmplpath, $param);
 302         $path = PVE::AccessControl::normalize_path($path);
 303         return $self->check_full($username, $path, $privs, $any, $noerr);
 304     } elsif ($test eq 'userid-group') {
 305         my $userid = $param->{userid};
 306         my ($t, $privs, %options) = @$check;
 307         return 0 if !$options{groups_param} && !$self->check_user_exist($userid, $noerr);
 308         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 309             my $groups = $self->filter_groups($username, $privs, 1);
 310             if ($options{groups_param}) {
 311                 my @group_param = PVE::Tools::split_list($param->{groups});
 312                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 313                 foreach my $pg (@group_param) {
 314                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 315                         if !$groups->{$pg};
 316                 }
 317             } else {
 318                 my $allowed_users = $self->group_member_join([keys %$groups]);
 319                 if (!$allowed_users->{$userid}) {
 320                     return 0 if $noerr;
 321                     raise_perm_exc();
 322                 }
 323             }
 324         }
 325         return 1;
 326     } elsif ($test eq 'userid-param') {
 327         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 328         my ($t, $subtest) = @$check;
 329         die "missing parameters" if !$subtest;
 330         if ($subtest eq 'self') {
 331             return 0 if !$self->check_user_exist($userid, $noerr);
 332             return 1 if $username eq $userid;
 333             return 0 if $noerr;
 334             raise_perm_exc();
 335         } elsif ($subtest eq 'Realm.AllocateUser') {
 336             my $path =  "/access/realm/$realm";
 337             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 338         } else {
 339             die "unknown userid-param test";
 340         }
 341      } elsif ($test eq 'perm-modify') {
 342         my ($t, $tmplpath) = @$check;
 343         my $path = PVE::Tools::template_replace($tmplpath, $param);
 344         $path = PVE::AccessControl::normalize_path($path);
 345         return $self->check_perm_modify($username, $path, $noerr);
 346    } else {
 347         die "unknown permission test";
 348     }
 349 };
 350
 351 sub check_api2_permissions {
 352     my ($self, $perm, $username, $param) = @_;
 353
 354     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 355
 356     raise_perm_exc("user != null") if !$username;
 357
 358     return 1 if $username eq 'root@pam';
 359
 360     raise_perm_exc('user != root@pam') if !$perm;
 361
 362     return 1 if $perm->{user} && $perm->{user} eq 'all';
 363
 364     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 365         if $perm->{check};
 366
 367     raise_perm_exc();
 368 }
 369
 370 sub log_cluster_msg {
 371     my ($self, $pri, $user, $msg) = @_;
 372
 373     PVE::Cluster::log_msg($pri, $user, $msg);
 374 }
 375
 376 sub broadcast_tasklist {
 377     my ($self, $tlist) = @_;
 378
 379     PVE::Cluster::broadcast_tasklist($tlist);
 380 }
 381
 382 # initialize environment - must be called once at program startup
 383 sub init {
 384     my ($class, $type, %params) = @_;
 385
 386     $class = ref($class) || $class;
 387
 388     my $self = $class->SUPER::init($type, %params);
 389
 390     $self->{user_cfg} = {};
 391     $self->{aclcache} = {};
 392     $self->{aclversion} = undef;
 393
 394     return $self;
 395 };
 396
 397
 398 # init_request - must be called before each RPC request
 399 sub init_request {
 400     my ($self, %params) = @_;
 401
 402     PVE::Cluster::cfs_update();
 403
 404     $self->{result_attributes} = {};
 405
 406     my $userconfig; # we use this for regression tests
 407     foreach my $p (keys %params) {
 408         if ($p eq 'userconfig') {
 409             $userconfig = $params{$p};
 410         } else {
 411             die "unknown parameter '$p'";
 412         }
 413     }
 414
 415     eval {
 416         $self->{aclcache} = {};
 417         if ($userconfig) {
 418             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 419             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 420             $self->{user_cfg} = $cfg;
 421         } else {
 422             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 423             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 424                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 425                 $self->{aclversion} = $ucvers;
 426                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 427                 $self->{user_cfg} = $cfg;
 428             }
 429         }
 430     };
 431     if (my $err = $@) {
 432         $self->{user_cfg} = {};
 433         die "Unable to load access control list: $err";
 434     }
 435 }
 436
 437 # hacks: to provide better backwards compatibiliy
 438
 439 # old code uses PVE::RPCEnvironment::get();
 440 # new code should use PVE::RPCEnvironment->get();
 441 sub get {
 442     return PVE::RESTEnvironment->get();
 443 }
 444
 445 # old code uses PVE::RPCEnvironment::is_worker();
 446 # new code should use PVE::RPCEnvironment->is_worker();
 447 sub is_worker {
 448     return PVE::RESTEnvironment->is_worker();
 449 }
 450
 451 1;