PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::RESTEnvironment;
   7
   8 use PVE::Exception qw(raise raise_perm_exc);
   9 use PVE::SafeSyslog;
  10 use PVE::Tools;
  11 use PVE::INotify;
  12 use PVE::Cluster;
  13 use PVE::ProcFSTools;
  14 use PVE::AccessControl;
  15
  16 use base qw(PVE::RESTEnvironment);
  17
  18 # FIXME: remove dependency to PVE::Storage;
  19
  20 # ACL cache
  21
  22 my $compile_acl_path = sub {
  23     my ($self, $user, $path) = @_;
  24
  25     my $cfg = $self->{user_cfg};
  26
  27     return undef if !$cfg->{roles};
  28
  29     die "internal error" if $user eq 'root@pam';
  30
  31     my $cache = $self->{aclcache};
  32     $cache->{$user} = {} if !$cache->{$user};
  33     my $data = $cache->{$user};
  34
  35     if (!$data->{poolroles}) {
  36         $data->{poolroles} = {};
  37
  38         foreach my $pool (keys %{$cfg->{pools}}) {
  39             my $d = $cfg->{pools}->{$pool};
  40             my @ra = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  41             next if !scalar(@ra);
  42             foreach my $vmid (keys %{$d->{vms}}) {
  43                 for my $role (@ra) {
  44                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  45                 }
  46             }
  47             foreach my $storeid (keys %{$d->{storage}}) {
  48                 for my $role (@ra) {
  49                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  50                 }
  51             }
  52         }
  53     }
  54
  55     my @ra = PVE::AccessControl::roles($cfg, $user, $path);
  56
  57     # apply roles inherited from pools
  58     # Note: assume we do not want to propagate those privs
  59     if ($data->{poolroles}->{$path}) {
  60         if (!($ra[0] && $ra[0] eq 'NoAccess')) {
  61             if ($data->{poolroles}->{$path}->{NoAccess}) {
  62                 @ra = ('NoAccess');
  63             } else {
  64                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  65                     push @ra, $role;
  66                 }
  67             }
  68         }
  69     }
  70
  71     $data->{roles}->{$path} = [ @ra ];
  72
  73     my $privs = {};
  74     foreach my $role (@ra) {
  75         if (my $privset = $cfg->{roles}->{$role}) {
  76             foreach my $p (keys %$privset) {
  77                 $privs->{$p} = 1;
  78             }
  79         }
  80     }
  81     $data->{privs}->{$path} = $privs;
  82
  83     return $privs;
  84 };
  85
  86 sub roles {
  87    my ($self, $user, $path) = @_;
  88
  89    if ($user eq 'root@pam') { # root can do anything
  90        return ('Administrator');
  91    }
  92
  93    $user = PVE::AccessControl::verify_username($user, 1);
  94    return () if !$user;
  95
  96    my $cache = $self->{aclcache};
  97    $cache->{$user} = {} if !$cache->{$user};
  98
  99    my $acl = $cache->{$user};
 100
 101    my $roles = $acl->{roles}->{$path};
 102    return @$roles if $roles;
 103
 104    &$compile_acl_path($self, $user, $path);
 105    $roles = $acl->{roles}->{$path} || [];
 106    return @$roles;
 107 }
 108
 109 sub permissions {
 110     my ($self, $user, $path) = @_;
 111
 112     if ($user eq 'root@pam') { # root can do anything
 113         my $cfg = $self->{user_cfg};
 114         return $cfg->{roles}->{'Administrator'};
 115     }
 116
 117     $user = PVE::AccessControl::verify_username($user, 1);
 118     return {} if !$user;
 119
 120     my $cache = $self->{aclcache};
 121     $cache->{$user} = {} if !$cache->{$user};
 122
 123     my $acl = $cache->{$user};
 124
 125     my $perm = $acl->{privs}->{$path};
 126     return $perm if $perm;
 127
 128     return &$compile_acl_path($self, $user, $path);
 129 }
 130
 131 sub check {
 132     my ($self, $user, $path, $privs, $noerr) = @_;
 133
 134     my $perm = $self->permissions($user, $path);
 135
 136     foreach my $priv (@$privs) {
 137         PVE::AccessControl::verify_privname($priv);
 138         if (!$perm->{$priv}) {
 139             return undef if $noerr;
 140             raise_perm_exc("$path, $priv");
 141         }
 142     };
 143
 144     return 1;
 145 };
 146
 147 sub check_any {
 148     my ($self, $user, $path, $privs, $noerr) = @_;
 149
 150     my $perm = $self->permissions($user, $path);
 151
 152     my $found = 0;
 153     foreach my $priv (@$privs) {
 154         PVE::AccessControl::verify_privname($priv);
 155         if ($perm->{$priv}) {
 156             $found = 1;
 157             last;
 158         }
 159     };
 160
 161     return 1 if $found;
 162
 163     return undef if $noerr;
 164
 165     raise_perm_exc("$path, " . join("|", @$privs));
 166 };
 167
 168 sub check_full {
 169     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 170     if ($any) {
 171         return $self->check_any($username, $path, $privs, $noerr);
 172     } else {
 173         return $self->check($username, $path, $privs, $noerr);
 174     }
 175 }
 176
 177 sub check_user_enabled {
 178     my ($self, $user, $noerr) = @_;
 179
 180     my $cfg = $self->{user_cfg};
 181     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 182 }
 183
 184 sub check_user_exist {
 185     my ($self, $user, $noerr) = @_;
 186
 187     my $cfg = $self->{user_cfg};
 188     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 189 }
 190
 191 sub check_pool_exist {
 192     my ($self, $pool, $noerr) = @_;
 193
 194     my $cfg = $self->{user_cfg};
 195
 196     return 1 if $cfg->{pools}->{$pool};
 197
 198     return undef if $noerr;
 199
 200     raise_perm_exc("pool '$pool' does not exist");
 201 }
 202
 203 sub check_vm_perm {
 204     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 205
 206     my $cfg = $self->{user_cfg};
 207
 208     if ($pool) {
 209         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 210     }
 211     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 212 };
 213
 214 sub check_volume_access {
 215     my ($self, $user, $storecfg, $vmid, $volid) = @_;
 216
 217     # test if we have read access to volid
 218
 219     my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 220     if ($sid) {
 221         my ($vtype, undef, $ownervm) = PVE::Storage::parse_volname($storecfg, $volid);
 222         if ($vtype eq 'iso' || $vtype eq 'vztmpl') {
 223             # we simply allow access
 224         } elsif (defined($ownervm) && defined($vmid) && ($ownervm == $vmid)) {
 225             # we are owner - allow access
 226         } elsif ($vtype eq 'backup' && $ownervm) {
 227             $self->check($user, "/storage/$sid", ['Datastore.AllocateSpace']);
 228             $self->check($user, "/vms/$ownervm", ['VM.Backup']);
 229         } else {
 230             # allow if we are Datastore administrator
 231             $self->check($user, "/storage/$sid", ['Datastore.Allocate']);
 232         }
 233     } else {
 234         die "Only root can pass arbitrary filesystem paths."
 235             if $user ne 'root@pam';
 236     }
 237
 238     return undef;
 239 }
 240
 241 sub is_group_member {
 242     my ($self, $group, $user) = @_;
 243
 244     my $cfg = $self->{user_cfg};
 245
 246     return 0 if !$cfg->{groups}->{$group};
 247
 248     return defined($cfg->{groups}->{$group}->{users}->{$user});
 249 }
 250
 251 sub filter_groups {
 252     my ($self, $user, $privs, $any) = @_;
 253
 254     my $cfg = $self->{user_cfg};
 255
 256     my $groups = {};
 257     foreach my $group (keys %{$cfg->{groups}}) {
 258         my $path = "/access/groups/$group";
 259         if ($self->check_full($user, $path, $privs, $any, 1)) {
 260             $groups->{$group} = $cfg->{groups}->{$group};
 261         }
 262     }
 263
 264     return $groups;
 265 }
 266
 267 sub group_member_join {
 268     my ($self, $grouplist) = @_;
 269
 270     my $users = {};
 271
 272     my $cfg = $self->{user_cfg};
 273     foreach my $group (@$grouplist) {
 274         my $data = $cfg->{groups}->{$group};
 275         next if !$data;
 276         foreach my $user (keys %{$data->{users}}) {
 277             $users->{$user} = 1;
 278         }
 279     }
 280
 281     return $users;
 282 }
 283
 284 sub check_perm_modify {
 285     my ($self, $username, $path, $noerr) = @_;
 286
 287     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 288
 289     my $testperms = [ 'Permissions.Modify' ];
 290     if ($path =~ m|^/storage/.+$|) {
 291         push @$testperms, 'Datastore.Allocate';
 292     } elsif ($path =~ m|^/vms/.+$|) {
 293         push @$testperms, 'VM.Allocate';
 294     } elsif ($path =~ m|^/pool/.+$|) {
 295         push @$testperms, 'Pool.Allocate';
 296     }
 297
 298     return $self->check_any($username, $path, $testperms, $noerr);
 299 }
 300
 301 sub exec_api2_perm_check {
 302     my ($self, $check, $username, $param, $noerr) = @_;
 303
 304     # syslog("info", "CHECK " . join(', ', @$check));
 305
 306     my $ind = 0;
 307     my $test = $check->[$ind++];
 308     die "no permission test specified" if !$test;
 309
 310     if ($test eq 'and') {
 311         while (my $subcheck = $check->[$ind++]) {
 312             $self->exec_api2_perm_check($subcheck, $username, $param);
 313         }
 314         return 1;
 315     } elsif ($test eq 'or') {
 316         while (my $subcheck = $check->[$ind++]) {
 317             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 318         }
 319         return 0 if $noerr;
 320         raise_perm_exc();
 321     } elsif ($test eq 'perm') {
 322         my ($t, $tmplpath, $privs, %options) = @$check;
 323         my $any = $options{any};
 324         die "missing parameters" if !($tmplpath && $privs);
 325         my $require_param = $options{require_param};
 326         if ($require_param && !defined($param->{$require_param})) {
 327             return 0 if $noerr;
 328             raise_perm_exc();
 329         }
 330         my $path = PVE::Tools::template_replace($tmplpath, $param);
 331         $path = PVE::AccessControl::normalize_path($path);
 332         return $self->check_full($username, $path, $privs, $any, $noerr);
 333     } elsif ($test eq 'userid-group') {
 334         my $userid = $param->{userid};
 335         my ($t, $privs, %options) = @$check;
 336         return 0 if !$options{groups_param} && !$self->check_user_exist($userid, $noerr);
 337         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 338             my $groups = $self->filter_groups($username, $privs, 1);
 339             if ($options{groups_param}) {
 340                 my @group_param = PVE::Tools::split_list($param->{groups});
 341                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 342                 foreach my $pg (@group_param) {
 343                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 344                         if !$groups->{$pg};
 345                 }
 346             } else {
 347                 my $allowed_users = $self->group_member_join([keys %$groups]);
 348                 if (!$allowed_users->{$userid}) {
 349                     return 0 if $noerr;
 350                     raise_perm_exc();
 351                 }
 352             }
 353         }
 354         return 1;
 355     } elsif ($test eq 'userid-param') {
 356         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 357         my ($t, $subtest) = @$check;
 358         die "missing parameters" if !$subtest;
 359         if ($subtest eq 'self') {
 360             return 0 if !$self->check_user_exist($userid, $noerr);
 361             return 1 if $username eq $userid;
 362             return 0 if $noerr;
 363             raise_perm_exc();
 364         } elsif ($subtest eq 'Realm.AllocateUser') {
 365             my $path =  "/access/realm/$realm";
 366             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 367         } else {
 368             die "unknown userid-param test";
 369         }
 370      } elsif ($test eq 'perm-modify') {
 371         my ($t, $tmplpath) = @$check;
 372         my $path = PVE::Tools::template_replace($tmplpath, $param);
 373         $path = PVE::AccessControl::normalize_path($path);
 374         return $self->check_perm_modify($username, $path, $noerr);
 375    } else {
 376         die "unknown permission test";
 377     }
 378 };
 379
 380 sub check_api2_permissions {
 381     my ($self, $perm, $username, $param) = @_;
 382
 383     return 1 if !$username && $perm->{user} eq 'world';
 384
 385     raise_perm_exc("user != null") if !$username;
 386
 387     return 1 if $username eq 'root@pam';
 388
 389     raise_perm_exc('user != root@pam') if !$perm;
 390
 391     return 1 if $perm->{user} && $perm->{user} eq 'all';
 392
 393     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 394         if $perm->{check};
 395
 396     raise_perm_exc();
 397 }
 398
 399 sub log_cluster_msg {
 400     my ($self, $pri, $user, $msg) = @_;
 401
 402     PVE::Cluster::log_msg($pri, $user, $msg);
 403 }
 404
 405 sub broadcast_tasklist {
 406     my ($self, $tlist) = @_;
 407
 408     PVE::Cluster::broadcast_tasklist($tlist);
 409 }
 410
 411 # initialize environment - must be called once at program startup
 412 sub init {
 413     my ($class, $type, %params) = @_;
 414
 415     $class = ref($class) || $class;
 416
 417     my $self = $class->SUPER::init($type, %params);
 418
 419     $self->{user_cfg} = {};
 420     $self->{aclcache} = {};
 421     $self->{aclversion} = undef;
 422
 423     return $self;
 424 };
 425
 426
 427 # init_request - must be called before each RPC request
 428 sub init_request {
 429     my ($self, %params) = @_;
 430
 431     PVE::Cluster::cfs_update();
 432
 433     $self->{result_attributes} = {};
 434
 435     my $userconfig; # we use this for regression tests
 436     foreach my $p (keys %params) {
 437         if ($p eq 'userconfig') {
 438             $userconfig = $params{$p};
 439         } else {
 440             die "unknown parameter '$p'";
 441         }
 442     }
 443
 444     eval {
 445         $self->{aclcache} = {};
 446         if ($userconfig) {
 447             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 448             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 449             $self->{user_cfg} = $cfg;
 450         } else {
 451             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 452             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 453                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 454                 $self->{aclversion} = $ucvers;
 455                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 456                 $self->{user_cfg} = $cfg;
 457             }
 458         }
 459     };
 460     if (my $err = $@) {
 461         $self->{user_cfg} = {};
 462         die "Unable to load access control list: $err";
 463     }
 464 }
 465
 466 # hacks: to provide better backwards compatibiliy
 467
 468 # old code uses PVE::RPCEnvironment::get();
 469 # new code should use PVE::RPCEnvironment->get();
 470 sub get {
 471     return PVE::RESTEnvironment->get();
 472 }
 473
 474 # old code uses PVE::RPCEnvironment::is_worker();
 475 # new code should use PVE::RPCEnvironment->is_worker();
 476 sub is_worker {
 477     return PVE::RESTEnvironment->is_worker();
 478 }
 479
 480 1;