src/PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AccessControl;
   7 use PVE::Cluster;
   8 use PVE::Exception qw(raise raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::ProcFSTools;
  11 use PVE::RESTEnvironment;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools;
  14
  15 use base qw(PVE::RESTEnvironment);
  16
  17 # ACL cache
  18
  19 my $compile_acl_path = sub {
  20     my ($self, $user, $path) = @_;
  21
  22     my $cfg = $self->{user_cfg};
  23
  24     return undef if !$cfg->{roles};
  25
  26     die "internal error" if $user eq 'root@pam';
  27
  28     my $cache = $self->{aclcache};
  29     $cache->{$user} = {} if !$cache->{$user};
  30     my $data = $cache->{$user};
  31
  32     my ($username, undef) = PVE::AccessControl::split_tokenid($user, 1);
  33     die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
  34
  35     if (!$data->{poolroles}) {
  36         $data->{poolroles} = {};
  37
  38         foreach my $pool (keys %{$cfg->{pools}}) {
  39             my $d = $cfg->{pools}->{$pool};
  40             my $pool_roles = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  41             next if !scalar(keys %$pool_roles);
  42             foreach my $vmid (keys %{$d->{vms}}) {
  43                 for my $role (keys %$pool_roles) {
  44                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  45                 }
  46             }
  47             foreach my $storeid (keys %{$d->{storage}}) {
  48                 for my $role (keys %$pool_roles) {
  49                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  50                 }
  51             }
  52         }
  53     }
  54
  55     my $roles = PVE::AccessControl::roles($cfg, $user, $path);
  56
  57     # apply roles inherited from pools
  58     # Note: assume we do not want to propagate those privs
  59     if ($data->{poolroles}->{$path}) {
  60         if (!defined($roles->{NoAccess})) {
  61             if ($data->{poolroles}->{$path}->{NoAccess}) {
  62                 $roles = { 'NoAccess' => 0 };
  63             } else {
  64                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  65                     $roles->{$role} = 0 if !defined($roles->{$role});
  66                 }
  67             }
  68         }
  69     }
  70
  71     $data->{roles}->{$path} = $roles;
  72
  73     my $privs = {};
  74     foreach my $role (keys %$roles) {
  75         if (my $privset = $cfg->{roles}->{$role}) {
  76             foreach my $p (keys %$privset) {
  77                 $privs->{$p} = $roles->{$role};
  78             }
  79         }
  80     }
  81
  82     if ($username && $username ne 'root@pam') {
  83         # intersect user and token permissions
  84         my $user_privs = $cache->{$username}->{privs}->{$path};
  85         $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } keys %$privs };
  86     }
  87
  88     $data->{privs}->{$path} = $privs;
  89
  90     return $privs;
  91 };
  92
  93 sub permissions {
  94     my ($self, $user, $path) = @_;
  95
  96     if ($user eq 'root@pam') { # root can do anything
  97         my $cfg = $self->{user_cfg};
  98         return { map { $_ => 1 } keys %{$cfg->{roles}->{'Administrator'}} };
  99     }
 100
 101     if (PVE::AccessControl::pve_verify_tokenid($user, 1)) {
 102         my ($username, $token) = PVE::AccessControl::split_tokenid($user);
 103         my $cfg = $self->{user_cfg};
 104         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
 105
 106         return {} if !$token_info;
 107
 108         # ensure cache for user is populated
 109         my $user_perms = $self->permissions($username, $path);
 110
 111         # return user privs for non-privsep tokens
 112         return $user_perms if !$token_info->{privsep};
 113     } else {
 114         $user = PVE::AccessControl::verify_username($user, 1);
 115         return {} if !$user;
 116     }
 117
 118     my $cache = $self->{aclcache};
 119     $cache->{$user} = {} if !$cache->{$user};
 120
 121     my $acl = $cache->{$user};
 122
 123     my $perm = $acl->{privs}->{$path};
 124     return $perm if $perm;
 125
 126     return &$compile_acl_path($self, $user, $path);
 127 }
 128
 129 sub compute_api_permission {
 130     my ($self, $authuser) = @_;
 131
 132     my $usercfg = $self->{user_cfg};
 133
 134     my $res = {};
 135     my $priv_re_map = {
 136         vms => qr/VM\.|Permissions\.Modify/,
 137         access => qr/(User|Group)\.|Permissions\.Modify/,
 138         storage => qr/Datastore\.|Permissions\.Modify/,
 139         nodes => qr/Sys\.|Permissions\.Modify/,
 140         sdn => qr/SDN\.|Permissions\.Modify/,
 141         dc => qr/Sys\.Audit|SDN\./,
 142     };
 143     map { $res->{$_} = {} } keys %$priv_re_map;
 144
 145     my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage', '/sdn'];
 146
 147     my $checked_paths = {};
 148     foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
 149         next if $checked_paths->{$path};
 150         $checked_paths->{$path} = 1;
 151
 152         my $path_perm = $self->permissions($authuser, $path);
 153
 154         my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
 155         if ($toplevel eq 'pool') {
 156             foreach my $priv (keys %$path_perm) {
 157                 if ($priv =~ m/^VM\./) {
 158                     $res->{vms}->{$priv} = 1;
 159                 } elsif ($priv =~ m/^Datastore\./) {
 160                     $res->{storage}->{$priv} = 1;
 161                 } elsif ($priv eq 'Permissions.Modify') {
 162                     $res->{storage}->{$priv} = 1;
 163                     $res->{vms}->{$priv} = 1;
 164                 }
 165             }
 166         } else {
 167             my $priv_regex = $priv_re_map->{$toplevel} // next;
 168             foreach my $priv (keys %$path_perm) {
 169                 next if $priv !~ m/^($priv_regex)/;
 170                 $res->{$toplevel}->{$priv} = 1;
 171             }
 172         }
 173     }
 174
 175     return $res;
 176 }
 177
 178 sub get_effective_permissions {
 179     my ($self, $user) = @_;
 180
 181     # default / top level paths
 182     my $paths = {
 183         '/' => 1,
 184         '/access' => 1,
 185         '/access/groups' => 1,
 186         '/nodes' => 1,
 187         '/pools' => 1,
 188         '/sdn' => 1,
 189         '/storage' => 1,
 190         '/vms' => 1,
 191     };
 192
 193     my $cfg = $self->{user_cfg};
 194
 195     # paths explicitly listed in ACLs
 196     foreach my $acl_path (keys %{$cfg->{acl}}) {
 197         $paths->{$acl_path} = 1;
 198     }
 199
 200     # paths referenced by pool definitions
 201     foreach my $pool (keys %{$cfg->{pools}}) {
 202         my $d = $cfg->{pools}->{$pool};
 203         foreach my $vmid (keys %{$d->{vms}}) {
 204             $paths->{"/vms/$vmid"} = 1;
 205         }
 206         foreach my $storeid (keys %{$d->{storage}}) {
 207             $paths->{"/storage/$storeid"} = 1;
 208         }
 209     }
 210
 211     my $perms = {};
 212     foreach my $path (keys %$paths) {
 213         my $path_perms = $self->permissions($user, $path);
 214         # filter paths where user has NO permissions
 215         $perms->{$path} = $path_perms if %$path_perms;
 216     }
 217     return $perms;
 218 }
 219
 220 sub check {
 221     my ($self, $user, $path, $privs, $noerr) = @_;
 222
 223     my $perm = $self->permissions($user, $path);
 224
 225     foreach my $priv (@$privs) {
 226         PVE::AccessControl::verify_privname($priv);
 227         if (!defined($perm->{$priv})) {
 228             return undef if $noerr;
 229             raise_perm_exc("$path, $priv");
 230         }
 231     };
 232
 233     return 1;
 234 };
 235
 236 sub check_any {
 237     my ($self, $user, $path, $privs, $noerr) = @_;
 238
 239     my $perm = $self->permissions($user, $path);
 240
 241     my $found = 0;
 242     foreach my $priv (@$privs) {
 243         PVE::AccessControl::verify_privname($priv);
 244         if (defined($perm->{$priv})) {
 245             $found = 1;
 246             last;
 247         }
 248     };
 249
 250     return 1 if $found;
 251
 252     return undef if $noerr;
 253
 254     raise_perm_exc("$path, " . join("|", @$privs));
 255 };
 256
 257 sub check_full {
 258     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 259     if ($any) {
 260         return $self->check_any($username, $path, $privs, $noerr);
 261     } else {
 262         return $self->check($username, $path, $privs, $noerr);
 263     }
 264 }
 265
 266 sub check_user_enabled {
 267     my ($self, $user, $noerr) = @_;
 268
 269     my $cfg = $self->{user_cfg};
 270     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 271 }
 272
 273 sub check_user_exist {
 274     my ($self, $user, $noerr) = @_;
 275
 276     my $cfg = $self->{user_cfg};
 277     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 278 }
 279
 280 sub check_pool_exist {
 281     my ($self, $pool, $noerr) = @_;
 282
 283     my $cfg = $self->{user_cfg};
 284
 285     return 1 if $cfg->{pools}->{$pool};
 286
 287     return undef if $noerr;
 288
 289     raise_perm_exc("pool '$pool' does not exist");
 290 }
 291
 292 sub check_vm_perm {
 293     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 294
 295     my $cfg = $self->{user_cfg};
 296
 297     if ($pool) {
 298         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 299     }
 300     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 301 };
 302
 303 sub is_group_member {
 304     my ($self, $group, $user) = @_;
 305
 306     my $cfg = $self->{user_cfg};
 307
 308     return 0 if !$cfg->{groups}->{$group};
 309
 310     return defined($cfg->{groups}->{$group}->{users}->{$user});
 311 }
 312
 313 sub filter_groups {
 314     my ($self, $user, $privs, $any) = @_;
 315
 316     my $cfg = $self->{user_cfg};
 317
 318     my $groups = {};
 319     foreach my $group (keys %{$cfg->{groups}}) {
 320         my $path = "/access/groups/$group";
 321         if ($self->check_full($user, $path, $privs, $any, 1)) {
 322             $groups->{$group} = $cfg->{groups}->{$group};
 323         }
 324     }
 325
 326     return $groups;
 327 }
 328
 329 sub group_member_join {
 330     my ($self, $grouplist) = @_;
 331
 332     my $users = {};
 333
 334     my $cfg = $self->{user_cfg};
 335     foreach my $group (@$grouplist) {
 336         my $data = $cfg->{groups}->{$group};
 337         next if !$data;
 338         foreach my $user (keys %{$data->{users}}) {
 339             $users->{$user} = 1;
 340         }
 341     }
 342
 343     return $users;
 344 }
 345
 346 sub check_perm_modify {
 347     my ($self, $username, $path, $noerr) = @_;
 348
 349     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 350
 351     my $testperms = [ 'Permissions.Modify' ];
 352     if ($path =~ m|^/storage/.+$|) {
 353         push @$testperms, 'Datastore.Allocate';
 354     } elsif ($path =~ m|^/vms/.+$|) {
 355         push @$testperms, 'VM.Allocate';
 356     } elsif ($path =~ m|^/pool/.+$|) {
 357         push @$testperms, 'Pool.Allocate';
 358     }
 359
 360     return $self->check_any($username, $path, $testperms, $noerr);
 361 }
 362
 363 sub exec_api2_perm_check {
 364     my ($self, $check, $username, $param, $noerr) = @_;
 365
 366     # syslog("info", "CHECK " . join(', ', @$check));
 367
 368     my $ind = 0;
 369     my $test = $check->[$ind++];
 370     die "no permission test specified" if !$test;
 371
 372     if ($test eq 'and') {
 373         while (my $subcheck = $check->[$ind++]) {
 374             $self->exec_api2_perm_check($subcheck, $username, $param);
 375         }
 376         return 1;
 377     } elsif ($test eq 'or') {
 378         while (my $subcheck = $check->[$ind++]) {
 379             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 380         }
 381         return 0 if $noerr;
 382         raise_perm_exc();
 383     } elsif ($test eq 'perm') {
 384         my ($t, $tmplpath, $privs, %options) = @$check;
 385         my $any = $options{any};
 386         die "missing parameters" if !($tmplpath && $privs);
 387         my $require_param = $options{require_param};
 388         if ($require_param && !defined($param->{$require_param})) {
 389             return 0 if $noerr;
 390             raise_perm_exc();
 391         }
 392         my $path = PVE::Tools::template_replace($tmplpath, $param);
 393         $path = PVE::AccessControl::normalize_path($path);
 394         return $self->check_full($username, $path, $privs, $any, $noerr);
 395     } elsif ($test eq 'userid-group') {
 396         my $userid = $param->{userid};
 397         my ($t, $privs, %options) = @$check;
 398         return 0 if !$options{groups_param} && !$self->check_user_exist($userid, $noerr);
 399         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 400             my $groups = $self->filter_groups($username, $privs, 1);
 401             if ($options{groups_param}) {
 402                 my @group_param = PVE::Tools::split_list($param->{groups});
 403                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 404                 foreach my $pg (@group_param) {
 405                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 406                         if !$groups->{$pg};
 407                 }
 408             } else {
 409                 my $allowed_users = $self->group_member_join([keys %$groups]);
 410                 if (!$allowed_users->{$userid}) {
 411                     return 0 if $noerr;
 412                     raise_perm_exc();
 413                 }
 414             }
 415         }
 416         return 1;
 417     } elsif ($test eq 'userid-param') {
 418         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 419         my ($t, $subtest) = @$check;
 420         die "missing parameters" if !$subtest;
 421         if ($subtest eq 'self') {
 422             return 0 if !$self->check_user_exist($userid, $noerr);
 423             return 1 if $username eq $userid;
 424             return 0 if $noerr;
 425             raise_perm_exc();
 426         } elsif ($subtest eq 'Realm.AllocateUser') {
 427             my $path =  "/access/realm/$realm";
 428             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 429         } else {
 430             die "unknown userid-param test";
 431         }
 432      } elsif ($test eq 'perm-modify') {
 433         my ($t, $tmplpath) = @$check;
 434         my $path = PVE::Tools::template_replace($tmplpath, $param);
 435         $path = PVE::AccessControl::normalize_path($path);
 436         return $self->check_perm_modify($username, $path, $noerr);
 437    } else {
 438         die "unknown permission test";
 439     }
 440 };
 441
 442 sub check_api2_permissions {
 443     my ($self, $perm, $username, $param) = @_;
 444
 445     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 446
 447     raise_perm_exc("user != null") if !$username;
 448
 449     return 1 if $username eq 'root@pam';
 450
 451     raise_perm_exc('user != root@pam') if !$perm;
 452
 453     return 1 if $perm->{user} && $perm->{user} eq 'all';
 454
 455     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 456         if $perm->{check};
 457
 458     raise_perm_exc();
 459 }
 460
 461 sub log_cluster_msg {
 462     my ($self, $pri, $user, $msg) = @_;
 463
 464     PVE::Cluster::log_msg($pri, $user, $msg);
 465 }
 466
 467 sub broadcast_tasklist {
 468     my ($self, $tlist) = @_;
 469
 470     PVE::Cluster::broadcast_tasklist($tlist);
 471 }
 472
 473 # initialize environment - must be called once at program startup
 474 sub init {
 475     my ($class, $type, %params) = @_;
 476
 477     $class = ref($class) || $class;
 478
 479     my $self = $class->SUPER::init($type, %params);
 480
 481     $self->{user_cfg} = {};
 482     $self->{aclcache} = {};
 483     $self->{aclversion} = undef;
 484
 485     return $self;
 486 };
 487
 488
 489 # init_request - must be called before each RPC request
 490 sub init_request {
 491     my ($self, %params) = @_;
 492
 493     PVE::Cluster::cfs_update();
 494
 495     $self->{result_attributes} = {};
 496
 497     my $userconfig; # we use this for regression tests
 498     foreach my $p (keys %params) {
 499         if ($p eq 'userconfig') {
 500             $userconfig = $params{$p};
 501         } else {
 502             die "unknown parameter '$p'";
 503         }
 504     }
 505
 506     eval {
 507         $self->{aclcache} = {};
 508         if ($userconfig) {
 509             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 510             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 511             $self->{user_cfg} = $cfg;
 512         } else {
 513             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 514             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 515                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 516                 $self->{aclversion} = $ucvers;
 517                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 518                 $self->{user_cfg} = $cfg;
 519             }
 520         }
 521     };
 522     if (my $err = $@) {
 523         $self->{user_cfg} = {};
 524         die "Unable to load access control list: $err";
 525     }
 526 }
 527
 528 # hacks: to provide better backwards compatibiliy
 529
 530 # old code uses PVE::RPCEnvironment::get();
 531 # new code should use PVE::RPCEnvironment->get();
 532 sub get {
 533     return PVE::RESTEnvironment->get();
 534 }
 535
 536 # old code uses PVE::RPCEnvironment::is_worker();
 537 # new code should use PVE::RPCEnvironment->is_worker();
 538 sub is_worker {
 539     return PVE::RESTEnvironment->is_worker();
 540 }
 541
 542 1;