src/PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::RESTEnvironment;
   7
   8 use PVE::Exception qw(raise raise_perm_exc);
   9 use PVE::SafeSyslog;
  10 use PVE::Tools;
  11 use PVE::INotify;
  12 use PVE::Cluster;
  13 use PVE::ProcFSTools;
  14 use PVE::AccessControl;
  15
  16 use base qw(PVE::RESTEnvironment);
  17
  18 # ACL cache
  19
  20 my $compile_acl_path = sub {
  21     my ($self, $user, $path) = @_;
  22
  23     my $cfg = $self->{user_cfg};
  24
  25     return undef if !$cfg->{roles};
  26
  27     die "internal error" if $user eq 'root@pam';
  28
  29     my $cache = $self->{aclcache};
  30     $cache->{$user} = {} if !$cache->{$user};
  31     my $data = $cache->{$user};
  32
  33     my ($username, undef) = PVE::AccessControl::split_tokenid($user, 1);
  34     die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
  35
  36     if (!$data->{poolroles}) {
  37         $data->{poolroles} = {};
  38
  39         foreach my $pool (keys %{$cfg->{pools}}) {
  40             my $d = $cfg->{pools}->{$pool};
  41             my $pool_roles = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  42             next if !scalar(keys %$pool_roles);
  43             foreach my $vmid (keys %{$d->{vms}}) {
  44                 for my $role (keys %$pool_roles) {
  45                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  46                 }
  47             }
  48             foreach my $storeid (keys %{$d->{storage}}) {
  49                 for my $role (keys %$pool_roles) {
  50                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  51                 }
  52             }
  53         }
  54     }
  55
  56     my $roles = PVE::AccessControl::roles($cfg, $user, $path);
  57
  58     # apply roles inherited from pools
  59     # Note: assume we do not want to propagate those privs
  60     if ($data->{poolroles}->{$path}) {
  61         if (!defined($roles->{NoAccess})) {
  62             if ($data->{poolroles}->{$path}->{NoAccess}) {
  63                 $roles = { 'NoAccess' => 0 };
  64             } else {
  65                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  66                     $roles->{$role} = 0 if !defined($roles->{$role});
  67                 }
  68             }
  69         }
  70     }
  71
  72     $data->{roles}->{$path} = $roles;
  73
  74     my $privs = {};
  75     foreach my $role (keys %$roles) {
  76         if (my $privset = $cfg->{roles}->{$role}) {
  77             foreach my $p (keys %$privset) {
  78                 $privs->{$p} = $roles->{$role};
  79             }
  80         }
  81     }
  82
  83     if ($username && $username ne 'root@pam') {
  84         # intersect user and token permissions
  85         my $user_privs = $cache->{$username}->{privs}->{$path};
  86         $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } keys %$privs };
  87     }
  88
  89     $data->{privs}->{$path} = $privs;
  90
  91     return $privs;
  92 };
  93
  94 sub permissions {
  95     my ($self, $user, $path) = @_;
  96
  97     if ($user eq 'root@pam') { # root can do anything
  98         my $cfg = $self->{user_cfg};
  99         return { map { $_ => 1 } keys %{$cfg->{roles}->{'Administrator'}} };
 100     }
 101
 102     if (PVE::AccessControl::pve_verify_tokenid($user, 1)) {
 103         my ($username, $token) = PVE::AccessControl::split_tokenid($user);
 104         my $cfg = $self->{user_cfg};
 105         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
 106
 107         return {} if !$token_info;
 108
 109         # ensure cache for user is populated
 110         my $user_perms = $self->permissions($username, $path);
 111
 112         # return user privs for non-privsep tokens
 113         return $user_perms if !$token_info->{privsep};
 114     } else {
 115         $user = PVE::AccessControl::verify_username($user, 1);
 116         return {} if !$user;
 117     }
 118
 119     my $cache = $self->{aclcache};
 120     $cache->{$user} = {} if !$cache->{$user};
 121
 122     my $acl = $cache->{$user};
 123
 124     my $perm = $acl->{privs}->{$path};
 125     return $perm if $perm;
 126
 127     return &$compile_acl_path($self, $user, $path);
 128 }
 129
 130 sub get_effective_permissions {
 131     my ($self, $user) = @_;
 132
 133     # default / top level paths
 134     my $paths = {
 135         '/' => 1,
 136         '/access' => 1,
 137         '/access/groups' => 1,
 138         '/nodes' => 1,
 139         '/pools' => 1,
 140         '/storage' => 1,
 141         '/vms' => 1,
 142     };
 143
 144     my $cfg = $self->{user_cfg};
 145
 146     # paths explicitly listed in ACLs
 147     foreach my $acl_path (keys %{$cfg->{acl}}) {
 148         $paths->{$acl_path} = 1;
 149     }
 150
 151     # paths referenced by pool definitions
 152     foreach my $pool (keys %{$cfg->{pools}}) {
 153         my $d = $cfg->{pools}->{$pool};
 154         foreach my $vmid (keys %{$d->{vms}}) {
 155             $paths->{"/vms/$vmid"} = 1;
 156         }
 157         foreach my $storeid (keys %{$d->{storage}}) {
 158             $paths->{"/storage/$storeid"} = 1;
 159         }
 160     }
 161
 162     my $perms = {};
 163     foreach my $path (keys %$paths) {
 164         my $path_perms = $self->permissions($user, $path);
 165         # filter paths where user has NO permissions
 166         $perms->{$path} = $path_perms if %$path_perms;
 167     }
 168     return $perms;
 169 }
 170
 171 sub check {
 172     my ($self, $user, $path, $privs, $noerr) = @_;
 173
 174     my $perm = $self->permissions($user, $path);
 175
 176     foreach my $priv (@$privs) {
 177         PVE::AccessControl::verify_privname($priv);
 178         if (!defined($perm->{$priv})) {
 179             return undef if $noerr;
 180             raise_perm_exc("$path, $priv");
 181         }
 182     };
 183
 184     return 1;
 185 };
 186
 187 sub check_any {
 188     my ($self, $user, $path, $privs, $noerr) = @_;
 189
 190     my $perm = $self->permissions($user, $path);
 191
 192     my $found = 0;
 193     foreach my $priv (@$privs) {
 194         PVE::AccessControl::verify_privname($priv);
 195         if (defined($perm->{$priv})) {
 196             $found = 1;
 197             last;
 198         }
 199     };
 200
 201     return 1 if $found;
 202
 203     return undef if $noerr;
 204
 205     raise_perm_exc("$path, " . join("|", @$privs));
 206 };
 207
 208 sub check_full {
 209     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 210     if ($any) {
 211         return $self->check_any($username, $path, $privs, $noerr);
 212     } else {
 213         return $self->check($username, $path, $privs, $noerr);
 214     }
 215 }
 216
 217 sub check_user_enabled {
 218     my ($self, $user, $noerr) = @_;
 219
 220     my $cfg = $self->{user_cfg};
 221     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 222 }
 223
 224 sub check_user_exist {
 225     my ($self, $user, $noerr) = @_;
 226
 227     my $cfg = $self->{user_cfg};
 228     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 229 }
 230
 231 sub check_pool_exist {
 232     my ($self, $pool, $noerr) = @_;
 233
 234     my $cfg = $self->{user_cfg};
 235
 236     return 1 if $cfg->{pools}->{$pool};
 237
 238     return undef if $noerr;
 239
 240     raise_perm_exc("pool '$pool' does not exist");
 241 }
 242
 243 sub check_vm_perm {
 244     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 245
 246     my $cfg = $self->{user_cfg};
 247
 248     if ($pool) {
 249         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 250     }
 251     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 252 };
 253
 254 sub is_group_member {
 255     my ($self, $group, $user) = @_;
 256
 257     my $cfg = $self->{user_cfg};
 258
 259     return 0 if !$cfg->{groups}->{$group};
 260
 261     return defined($cfg->{groups}->{$group}->{users}->{$user});
 262 }
 263
 264 sub filter_groups {
 265     my ($self, $user, $privs, $any) = @_;
 266
 267     my $cfg = $self->{user_cfg};
 268
 269     my $groups = {};
 270     foreach my $group (keys %{$cfg->{groups}}) {
 271         my $path = "/access/groups/$group";
 272         if ($self->check_full($user, $path, $privs, $any, 1)) {
 273             $groups->{$group} = $cfg->{groups}->{$group};
 274         }
 275     }
 276
 277     return $groups;
 278 }
 279
 280 sub group_member_join {
 281     my ($self, $grouplist) = @_;
 282
 283     my $users = {};
 284
 285     my $cfg = $self->{user_cfg};
 286     foreach my $group (@$grouplist) {
 287         my $data = $cfg->{groups}->{$group};
 288         next if !$data;
 289         foreach my $user (keys %{$data->{users}}) {
 290             $users->{$user} = 1;
 291         }
 292     }
 293
 294     return $users;
 295 }
 296
 297 sub check_perm_modify {
 298     my ($self, $username, $path, $noerr) = @_;
 299
 300     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 301
 302     my $testperms = [ 'Permissions.Modify' ];
 303     if ($path =~ m|^/storage/.+$|) {
 304         push @$testperms, 'Datastore.Allocate';
 305     } elsif ($path =~ m|^/vms/.+$|) {
 306         push @$testperms, 'VM.Allocate';
 307     } elsif ($path =~ m|^/pool/.+$|) {
 308         push @$testperms, 'Pool.Allocate';
 309     }
 310
 311     return $self->check_any($username, $path, $testperms, $noerr);
 312 }
 313
 314 sub exec_api2_perm_check {
 315     my ($self, $check, $username, $param, $noerr) = @_;
 316
 317     # syslog("info", "CHECK " . join(', ', @$check));
 318
 319     my $ind = 0;
 320     my $test = $check->[$ind++];
 321     die "no permission test specified" if !$test;
 322
 323     if ($test eq 'and') {
 324         while (my $subcheck = $check->[$ind++]) {
 325             $self->exec_api2_perm_check($subcheck, $username, $param);
 326         }
 327         return 1;
 328     } elsif ($test eq 'or') {
 329         while (my $subcheck = $check->[$ind++]) {
 330             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 331         }
 332         return 0 if $noerr;
 333         raise_perm_exc();
 334     } elsif ($test eq 'perm') {
 335         my ($t, $tmplpath, $privs, %options) = @$check;
 336         my $any = $options{any};
 337         die "missing parameters" if !($tmplpath && $privs);
 338         my $require_param = $options{require_param};
 339         if ($require_param && !defined($param->{$require_param})) {
 340             return 0 if $noerr;
 341             raise_perm_exc();
 342         }
 343         my $path = PVE::Tools::template_replace($tmplpath, $param);
 344         $path = PVE::AccessControl::normalize_path($path);
 345         return $self->check_full($username, $path, $privs, $any, $noerr);
 346     } elsif ($test eq 'userid-group') {
 347         my $userid = $param->{userid};
 348         my ($t, $privs, %options) = @$check;
 349         return 0 if !$options{groups_param} && !$self->check_user_exist($userid, $noerr);
 350         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 351             my $groups = $self->filter_groups($username, $privs, 1);
 352             if ($options{groups_param}) {
 353                 my @group_param = PVE::Tools::split_list($param->{groups});
 354                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 355                 foreach my $pg (@group_param) {
 356                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 357                         if !$groups->{$pg};
 358                 }
 359             } else {
 360                 my $allowed_users = $self->group_member_join([keys %$groups]);
 361                 if (!$allowed_users->{$userid}) {
 362                     return 0 if $noerr;
 363                     raise_perm_exc();
 364                 }
 365             }
 366         }
 367         return 1;
 368     } elsif ($test eq 'userid-param') {
 369         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 370         my ($t, $subtest) = @$check;
 371         die "missing parameters" if !$subtest;
 372         if ($subtest eq 'self') {
 373             return 0 if !$self->check_user_exist($userid, $noerr);
 374             return 1 if $username eq $userid;
 375             return 0 if $noerr;
 376             raise_perm_exc();
 377         } elsif ($subtest eq 'Realm.AllocateUser') {
 378             my $path =  "/access/realm/$realm";
 379             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 380         } else {
 381             die "unknown userid-param test";
 382         }
 383      } elsif ($test eq 'perm-modify') {
 384         my ($t, $tmplpath) = @$check;
 385         my $path = PVE::Tools::template_replace($tmplpath, $param);
 386         $path = PVE::AccessControl::normalize_path($path);
 387         return $self->check_perm_modify($username, $path, $noerr);
 388    } else {
 389         die "unknown permission test";
 390     }
 391 };
 392
 393 sub check_api2_permissions {
 394     my ($self, $perm, $username, $param) = @_;
 395
 396     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 397
 398     raise_perm_exc("user != null") if !$username;
 399
 400     return 1 if $username eq 'root@pam';
 401
 402     raise_perm_exc('user != root@pam') if !$perm;
 403
 404     return 1 if $perm->{user} && $perm->{user} eq 'all';
 405
 406     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 407         if $perm->{check};
 408
 409     raise_perm_exc();
 410 }
 411
 412 sub log_cluster_msg {
 413     my ($self, $pri, $user, $msg) = @_;
 414
 415     PVE::Cluster::log_msg($pri, $user, $msg);
 416 }
 417
 418 sub broadcast_tasklist {
 419     my ($self, $tlist) = @_;
 420
 421     PVE::Cluster::broadcast_tasklist($tlist);
 422 }
 423
 424 # initialize environment - must be called once at program startup
 425 sub init {
 426     my ($class, $type, %params) = @_;
 427
 428     $class = ref($class) || $class;
 429
 430     my $self = $class->SUPER::init($type, %params);
 431
 432     $self->{user_cfg} = {};
 433     $self->{aclcache} = {};
 434     $self->{aclversion} = undef;
 435
 436     return $self;
 437 };
 438
 439
 440 # init_request - must be called before each RPC request
 441 sub init_request {
 442     my ($self, %params) = @_;
 443
 444     PVE::Cluster::cfs_update();
 445
 446     $self->{result_attributes} = {};
 447
 448     my $userconfig; # we use this for regression tests
 449     foreach my $p (keys %params) {
 450         if ($p eq 'userconfig') {
 451             $userconfig = $params{$p};
 452         } else {
 453             die "unknown parameter '$p'";
 454         }
 455     }
 456
 457     eval {
 458         $self->{aclcache} = {};
 459         if ($userconfig) {
 460             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 461             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 462             $self->{user_cfg} = $cfg;
 463         } else {
 464             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 465             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 466                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 467                 $self->{aclversion} = $ucvers;
 468                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 469                 $self->{user_cfg} = $cfg;
 470             }
 471         }
 472     };
 473     if (my $err = $@) {
 474         $self->{user_cfg} = {};
 475         die "Unable to load access control list: $err";
 476     }
 477 }
 478
 479 # hacks: to provide better backwards compatibiliy
 480
 481 # old code uses PVE::RPCEnvironment::get();
 482 # new code should use PVE::RPCEnvironment->get();
 483 sub get {
 484     return PVE::RESTEnvironment->get();
 485 }
 486
 487 # old code uses PVE::RPCEnvironment::is_worker();
 488 # new code should use PVE::RPCEnvironment->is_worker();
 489 sub is_worker {
 490     return PVE::RESTEnvironment->is_worker();
 491 }
 492
 493 1;