1 package PVE
::RPCEnvironment
;
6 use PVE
::RESTEnvironment
;
8 use PVE
::Exception
qw(raise raise_perm_exc);
14 use PVE
::AccessControl
;
16 use base
qw(PVE::RESTEnvironment);
20 my $compile_acl_path = sub {
21 my ($self, $user, $path) = @_;
23 my $cfg = $self->{user_cfg
};
25 return undef if !$cfg->{roles
};
27 die "internal error" if $user eq 'root@pam';
29 my $cache = $self->{aclcache
};
30 $cache->{$user} = {} if !$cache->{$user};
31 my $data = $cache->{$user};
33 my ($username, undef) = PVE
::AccessControl
::split_tokenid
($user, 1);
34 die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
36 if (!$data->{poolroles
}) {
37 $data->{poolroles
} = {};
39 foreach my $pool (keys %{$cfg->{pools
}}) {
40 my $d = $cfg->{pools
}->{$pool};
41 my $pool_roles = PVE
::AccessControl
::roles
($cfg, $user, "/pool/$pool"); # pool roles
42 next if !scalar(keys %$pool_roles);
43 foreach my $vmid (keys %{$d->{vms
}}) {
44 for my $role (keys %$pool_roles) {
45 $data->{poolroles
}->{"/vms/$vmid"}->{$role} = 1;
48 foreach my $storeid (keys %{$d->{storage
}}) {
49 for my $role (keys %$pool_roles) {
50 $data->{poolroles
}->{"/storage/$storeid"}->{$role} = 1;
56 my $roles = PVE
::AccessControl
::roles
($cfg, $user, $path);
58 # apply roles inherited from pools
59 # Note: assume we do not want to propagate those privs
60 if ($data->{poolroles
}->{$path}) {
61 if (!defined($roles->{NoAccess
})) {
62 if ($data->{poolroles
}->{$path}->{NoAccess
}) {
63 $roles = { 'NoAccess' => 0 };
65 foreach my $role (keys %{$data->{poolroles
}->{$path}}) {
66 $roles->{$role} = 0 if !defined($roles->{$role});
72 $data->{roles
}->{$path} = $roles;
75 foreach my $role (keys %$roles) {
76 if (my $privset = $cfg->{roles
}->{$role}) {
77 foreach my $p (keys %$privset) {
78 $privs->{$p} = $roles->{$role};
83 if ($username && $username ne 'root@pam') {
84 # intersect user and token permissions
85 my $user_privs = $cache->{$username}->{privs
}->{$path};
86 $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } keys %$privs };
89 $data->{privs
}->{$path} = $privs;
95 my ($self, $user, $path) = @_;
97 if ($user eq 'root@pam') { # root can do anything
98 my $cfg = $self->{user_cfg
};
99 return { map { $_ => 1 } keys %{$cfg->{roles
}->{'Administrator'}} };
102 if (PVE
::AccessControl
::pve_verify_tokenid
($user, 1)) {
103 my ($username, $token) = PVE
::AccessControl
::split_tokenid
($user);
104 my $cfg = $self->{user_cfg
};
105 my $token_info = $cfg->{users
}->{$username}->{tokens
}->{$token};
107 return {} if !$token_info;
109 # ensure cache for user is populated
110 my $user_perms = $self->permissions($username, $path);
112 # return user privs for non-privsep tokens
113 return $user_perms if !$token_info->{privsep
};
115 $user = PVE
::AccessControl
::verify_username
($user, 1);
119 my $cache = $self->{aclcache
};
120 $cache->{$user} = {} if !$cache->{$user};
122 my $acl = $cache->{$user};
124 my $perm = $acl->{privs
}->{$path};
125 return $perm if $perm;
127 return &$compile_acl_path($self, $user, $path);
130 sub get_effective_permissions
{
131 my ($self, $user) = @_;
133 # default / top level paths
137 '/access/groups' => 1,
144 my $cfg = $self->{user_cfg
};
146 # paths explicitly listed in ACLs
147 foreach my $acl_path (keys %{$cfg->{acl
}}) {
148 $paths->{$acl_path} = 1;
151 # paths referenced by pool definitions
152 foreach my $pool (keys %{$cfg->{pools
}}) {
153 my $d = $cfg->{pools
}->{$pool};
154 foreach my $vmid (keys %{$d->{vms
}}) {
155 $paths->{"/vms/$vmid"} = 1;
157 foreach my $storeid (keys %{$d->{storage
}}) {
158 $paths->{"/storage/$storeid"} = 1;
163 foreach my $path (keys %$paths) {
164 my $path_perms = $self->permissions($user, $path);
165 # filter paths where user has NO permissions
166 $perms->{$path} = $path_perms if %$path_perms;
172 my ($self, $user, $path, $privs, $noerr) = @_;
174 my $perm = $self->permissions($user, $path);
176 foreach my $priv (@$privs) {
177 PVE
::AccessControl
::verify_privname
($priv);
178 if (!defined($perm->{$priv})) {
179 return undef if $noerr;
180 raise_perm_exc
("$path, $priv");
188 my ($self, $user, $path, $privs, $noerr) = @_;
190 my $perm = $self->permissions($user, $path);
193 foreach my $priv (@$privs) {
194 PVE
::AccessControl
::verify_privname
($priv);
195 if (defined($perm->{$priv})) {
203 return undef if $noerr;
205 raise_perm_exc
("$path, " . join("|", @$privs));
209 my ($self, $username, $path, $privs, $any, $noerr) = @_;
211 return $self->check_any($username, $path, $privs, $noerr);
213 return $self->check($username, $path, $privs, $noerr);
217 sub check_user_enabled
{
218 my ($self, $user, $noerr) = @_;
220 my $cfg = $self->{user_cfg
};
221 return PVE
::AccessControl
::check_user_enabled
($cfg, $user, $noerr);
224 sub check_user_exist
{
225 my ($self, $user, $noerr) = @_;
227 my $cfg = $self->{user_cfg
};
228 return PVE
::AccessControl
::check_user_exist
($cfg, $user, $noerr);
231 sub check_pool_exist
{
232 my ($self, $pool, $noerr) = @_;
234 my $cfg = $self->{user_cfg
};
236 return 1 if $cfg->{pools
}->{$pool};
238 return undef if $noerr;
240 raise_perm_exc
("pool '$pool' does not exist");
244 my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
246 my $cfg = $self->{user_cfg
};
249 return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
251 return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
254 sub is_group_member
{
255 my ($self, $group, $user) = @_;
257 my $cfg = $self->{user_cfg
};
259 return 0 if !$cfg->{groups
}->{$group};
261 return defined($cfg->{groups
}->{$group}->{users
}->{$user});
265 my ($self, $user, $privs, $any) = @_;
267 my $cfg = $self->{user_cfg
};
270 foreach my $group (keys %{$cfg->{groups
}}) {
271 my $path = "/access/groups/$group";
272 if ($self->check_full($user, $path, $privs, $any, 1)) {
273 $groups->{$group} = $cfg->{groups
}->{$group};
280 sub group_member_join
{
281 my ($self, $grouplist) = @_;
285 my $cfg = $self->{user_cfg
};
286 foreach my $group (@$grouplist) {
287 my $data = $cfg->{groups
}->{$group};
289 foreach my $user (keys %{$data->{users
}}) {
297 sub check_perm_modify
{
298 my ($self, $username, $path, $noerr) = @_;
300 return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
302 my $testperms = [ 'Permissions.Modify' ];
303 if ($path =~ m
|^/storage/.+$|) {
304 push @$testperms, 'Datastore.Allocate';
305 } elsif ($path =~ m
|^/vms/.+$|) {
306 push @$testperms, 'VM.Allocate';
307 } elsif ($path =~ m
|^/pool/.+$|) {
308 push @$testperms, 'Pool.Allocate';
311 return $self->check_any($username, $path, $testperms, $noerr);
314 sub exec_api2_perm_check
{
315 my ($self, $check, $username, $param, $noerr) = @_;
317 # syslog("info", "CHECK " . join(', ', @$check));
320 my $test = $check->[$ind++];
321 die "no permission test specified" if !$test;
323 if ($test eq 'and') {
324 while (my $subcheck = $check->[$ind++]) {
325 $self->exec_api2_perm_check($subcheck, $username, $param);
328 } elsif ($test eq 'or') {
329 while (my $subcheck = $check->[$ind++]) {
330 return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
334 } elsif ($test eq 'perm') {
335 my ($t, $tmplpath, $privs, %options) = @$check;
336 my $any = $options{any
};
337 die "missing parameters" if !($tmplpath && $privs);
338 my $require_param = $options{require_param
};
339 if ($require_param && !defined($param->{$require_param})) {
343 my $path = PVE
::Tools
::template_replace
($tmplpath, $param);
344 $path = PVE
::AccessControl
::normalize_path
($path);
345 return $self->check_full($username, $path, $privs, $any, $noerr);
346 } elsif ($test eq 'userid-group') {
347 my $userid = $param->{userid
};
348 my ($t, $privs, %options) = @$check;
349 return 0 if !$options{groups_param
} && !$self->check_user_exist($userid, $noerr);
350 if (!$self->check_any($username, "/access/groups", $privs, 1)) {
351 my $groups = $self->filter_groups($username, $privs, 1);
352 if ($options{groups_param
}) {
353 my @group_param = PVE
::Tools
::split_list
($param->{groups
});
354 raise_perm_exc
("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
355 foreach my $pg (@group_param) {
356 raise_perm_exc
("/access/groups/$pg, " . join("|", @$privs))
360 my $allowed_users = $self->group_member_join([keys %$groups]);
361 if (!$allowed_users->{$userid}) {
368 } elsif ($test eq 'userid-param') {
369 my ($userid, undef, $realm) = PVE
::AccessControl
::verify_username
($param->{userid
});
370 my ($t, $subtest) = @$check;
371 die "missing parameters" if !$subtest;
372 if ($subtest eq 'self') {
373 return 0 if !$self->check_user_exist($userid, $noerr);
374 return 1 if $username eq $userid;
377 } elsif ($subtest eq 'Realm.AllocateUser') {
378 my $path = "/access/realm/$realm";
379 return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
381 die "unknown userid-param test";
383 } elsif ($test eq 'perm-modify') {
384 my ($t, $tmplpath) = @$check;
385 my $path = PVE
::Tools
::template_replace
($tmplpath, $param);
386 $path = PVE
::AccessControl
::normalize_path
($path);
387 return $self->check_perm_modify($username, $path, $noerr);
389 die "unknown permission test";
393 sub check_api2_permissions
{
394 my ($self, $perm, $username, $param) = @_;
396 return 1 if !$username && $perm->{user
} && $perm->{user
} eq 'world';
398 raise_perm_exc
("user != null") if !$username;
400 return 1 if $username eq 'root@pam';
402 raise_perm_exc
('user != root@pam') if !$perm;
404 return 1 if $perm->{user
} && $perm->{user
} eq 'all';
406 return $self->exec_api2_perm_check($perm->{check
}, $username, $param)
412 sub log_cluster_msg
{
413 my ($self, $pri, $user, $msg) = @_;
415 PVE
::Cluster
::log_msg
($pri, $user, $msg);
418 sub broadcast_tasklist
{
419 my ($self, $tlist) = @_;
421 PVE
::Cluster
::broadcast_tasklist
($tlist);
424 # initialize environment - must be called once at program startup
426 my ($class, $type, %params) = @_;
428 $class = ref($class) || $class;
430 my $self = $class->SUPER::init
($type, %params);
432 $self->{user_cfg
} = {};
433 $self->{aclcache
} = {};
434 $self->{aclversion
} = undef;
440 # init_request - must be called before each RPC request
442 my ($self, %params) = @_;
444 PVE
::Cluster
::cfs_update
();
446 $self->{result_attributes
} = {};
448 my $userconfig; # we use this for regression tests
449 foreach my $p (keys %params) {
450 if ($p eq 'userconfig') {
451 $userconfig = $params{$p};
453 die "unknown parameter '$p'";
458 $self->{aclcache
} = {};
460 my $ucdata = PVE
::Tools
::file_get_contents
($userconfig);
461 my $cfg = PVE
::AccessControl
::parse_user_config
($userconfig, $ucdata);
462 $self->{user_cfg
} = $cfg;
464 my $ucvers = PVE
::Cluster
::cfs_file_version
('user.cfg');
465 if (!$self->{aclcache
} || !defined($self->{aclversion
}) ||
466 !defined($ucvers) || ($ucvers ne $self->{aclversion
})) {
467 $self->{aclversion
} = $ucvers;
468 my $cfg = PVE
::Cluster
::cfs_read_file
('user.cfg');
469 $self->{user_cfg
} = $cfg;
474 $self->{user_cfg
} = {};
475 die "Unable to load access control list: $err";
479 # hacks: to provide better backwards compatibiliy
481 # old code uses PVE::RPCEnvironment::get();
482 # new code should use PVE::RPCEnvironment->get();
484 return PVE
::RESTEnvironment-
>get();
487 # old code uses PVE::RPCEnvironment::is_worker();
488 # new code should use PVE::RPCEnvironment->is_worker();
490 return PVE
::RESTEnvironment-
>is_worker();