src/PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AccessControl;
   7 use PVE::Cluster;
   8 use PVE::Exception qw(raise raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::ProcFSTools;
  11 use PVE::RESTEnvironment;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools;
  14
  15 use base qw(PVE::RESTEnvironment);
  16
  17 # ACL cache
  18
  19 my $compile_acl_path = sub {
  20     my ($self, $user, $path) = @_;
  21
  22     my $cfg = $self->{user_cfg};
  23
  24     return undef if !$cfg->{roles};
  25
  26     die "internal error" if $user eq 'root@pam';
  27
  28     my $cache = $self->{aclcache};
  29     $cache->{$user} = {} if !$cache->{$user};
  30     my $data = $cache->{$user};
  31
  32     my ($username, undef) = PVE::AccessControl::split_tokenid($user, 1);
  33     die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
  34
  35     if (!$data->{poolroles}) {
  36         $data->{poolroles} = {};
  37
  38         foreach my $pool (keys %{$cfg->{pools}}) {
  39             my $d = $cfg->{pools}->{$pool};
  40             my $pool_roles = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  41             next if !scalar(keys %$pool_roles);
  42             foreach my $vmid (keys %{$d->{vms}}) {
  43                 for my $role (keys %$pool_roles) {
  44                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  45                 }
  46             }
  47             foreach my $storeid (keys %{$d->{storage}}) {
  48                 for my $role (keys %$pool_roles) {
  49                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  50                 }
  51             }
  52         }
  53     }
  54
  55     my $roles = PVE::AccessControl::roles($cfg, $user, $path);
  56
  57     # apply roles inherited from pools
  58     # Note: assume we do not want to propagate those privs
  59     if ($data->{poolroles}->{$path}) {
  60         if (!defined($roles->{NoAccess})) {
  61             if ($data->{poolroles}->{$path}->{NoAccess}) {
  62                 $roles = { 'NoAccess' => 0 };
  63             } else {
  64                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  65                     $roles->{$role} = 0 if !defined($roles->{$role});
  66                 }
  67             }
  68         }
  69     }
  70
  71     $data->{roles}->{$path} = $roles;
  72
  73     my $privs = {};
  74     foreach my $role (keys %$roles) {
  75         if (my $privset = $cfg->{roles}->{$role}) {
  76             foreach my $p (keys %$privset) {
  77                 $privs->{$p} = $roles->{$role};
  78             }
  79         }
  80     }
  81
  82     if ($username && $username ne 'root@pam') {
  83         # intersect user and token permissions
  84         my $user_privs = $cache->{$username}->{privs}->{$path};
  85         my $filtered_privs = [ grep { $user_privs->{$_} } keys %$privs ];
  86         $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } @$filtered_privs };
  87     }
  88
  89     foreach my $priv (keys %$privs) {
  90         # safeguard, this should never happen anyway
  91         delete $privs->{$priv} if !defined($privs->{$priv});
  92     }
  93
  94     $data->{privs}->{$path} = $privs;
  95
  96     return $privs;
  97 };
  98
  99 sub permissions {
 100     my ($self, $user, $path) = @_;
 101
 102     if ($user eq 'root@pam') { # root can do anything
 103         my $cfg = $self->{user_cfg};
 104         return { map { $_ => 1 } keys %{$cfg->{roles}->{'Administrator'}} };
 105     }
 106
 107     if (PVE::AccessControl::pve_verify_tokenid($user, 1)) {
 108         my ($username, $token) = PVE::AccessControl::split_tokenid($user);
 109         my $cfg = $self->{user_cfg};
 110         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
 111
 112         return {} if !$token_info;
 113
 114         # ensure cache for user is populated
 115         my $user_perms = $self->permissions($username, $path);
 116
 117         # return user privs for non-privsep tokens
 118         return $user_perms if !$token_info->{privsep};
 119     } else {
 120         $user = PVE::AccessControl::verify_username($user, 1);
 121         return {} if !$user;
 122     }
 123
 124     my $cache = $self->{aclcache};
 125     $cache->{$user} = {} if !$cache->{$user};
 126
 127     my $acl = $cache->{$user};
 128
 129     my $perm = $acl->{privs}->{$path};
 130     return $perm if $perm;
 131
 132     return &$compile_acl_path($self, $user, $path);
 133 }
 134
 135 sub compute_api_permission {
 136     my ($self, $authuser) = @_;
 137
 138     my $usercfg = $self->{user_cfg};
 139
 140     my $res = {};
 141     my $priv_re_map = {
 142         vms => qr/VM\.|Permissions\.Modify/,
 143         access => qr/(User|Group)\.|Permissions\.Modify/,
 144         storage => qr/Datastore\.|Permissions\.Modify/,
 145         nodes => qr/Sys\.|Permissions\.Modify/,
 146         sdn => qr/SDN\.|Permissions\.Modify/,
 147         dc => qr/Sys\.Audit|SDN\./,
 148     };
 149     map { $res->{$_} = {} } keys %$priv_re_map;
 150
 151     my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage', '/sdn'];
 152
 153     my $checked_paths = {};
 154     foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
 155         next if $checked_paths->{$path};
 156         $checked_paths->{$path} = 1;
 157
 158         my $path_perm = $self->permissions($authuser, $path);
 159
 160         my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
 161         if ($toplevel eq 'pool') {
 162             foreach my $priv (keys %$path_perm) {
 163                 next if !defined($path_perm->{$priv});
 164
 165                 if ($priv =~ m/^VM\./) {
 166                     $res->{vms}->{$priv} = 1;
 167                 } elsif ($priv =~ m/^Datastore\./) {
 168                     $res->{storage}->{$priv} = 1;
 169                 } elsif ($priv eq 'Permissions.Modify') {
 170                     $res->{storage}->{$priv} = 1;
 171                     $res->{vms}->{$priv} = 1;
 172                 }
 173             }
 174         } else {
 175             my $priv_regex = $priv_re_map->{$toplevel} // next;
 176             foreach my $priv (keys %$path_perm) {
 177                 next if !defined($path_perm->{$priv});
 178
 179                 next if $priv !~ m/^($priv_regex)/;
 180                 $res->{$toplevel}->{$priv} = 1;
 181             }
 182         }
 183     }
 184
 185     return $res;
 186 }
 187
 188 sub get_effective_permissions {
 189     my ($self, $user) = @_;
 190
 191     # default / top level paths
 192     my $paths = {
 193         '/' => 1,
 194         '/access' => 1,
 195         '/access/groups' => 1,
 196         '/nodes' => 1,
 197         '/pools' => 1,
 198         '/sdn' => 1,
 199         '/storage' => 1,
 200         '/vms' => 1,
 201     };
 202
 203     my $cfg = $self->{user_cfg};
 204
 205     # paths explicitly listed in ACLs
 206     foreach my $acl_path (keys %{$cfg->{acl}}) {
 207         $paths->{$acl_path} = 1;
 208     }
 209
 210     # paths referenced by pool definitions
 211     foreach my $pool (keys %{$cfg->{pools}}) {
 212         my $d = $cfg->{pools}->{$pool};
 213         foreach my $vmid (keys %{$d->{vms}}) {
 214             $paths->{"/vms/$vmid"} = 1;
 215         }
 216         foreach my $storeid (keys %{$d->{storage}}) {
 217             $paths->{"/storage/$storeid"} = 1;
 218         }
 219     }
 220
 221     my $perms = {};
 222     foreach my $path (keys %$paths) {
 223         my $path_perms = $self->permissions($user, $path);
 224         foreach my $priv (keys %$path_perms) {
 225             delete $path_perms->{$priv} if !defined($path_perms->{$priv});
 226         }
 227         # filter paths where user has NO permissions
 228         $perms->{$path} = $path_perms if %$path_perms;
 229     }
 230     return $perms;
 231 }
 232
 233 sub check {
 234     my ($self, $user, $path, $privs, $noerr) = @_;
 235
 236     my $perm = $self->permissions($user, $path);
 237
 238     foreach my $priv (@$privs) {
 239         PVE::AccessControl::verify_privname($priv);
 240         if (!defined($perm->{$priv})) {
 241             return undef if $noerr;
 242             raise_perm_exc("$path, $priv");
 243         }
 244     };
 245
 246     return 1;
 247 };
 248
 249 sub check_any {
 250     my ($self, $user, $path, $privs, $noerr) = @_;
 251
 252     my $perm = $self->permissions($user, $path);
 253
 254     my $found = 0;
 255     foreach my $priv (@$privs) {
 256         PVE::AccessControl::verify_privname($priv);
 257         if (defined($perm->{$priv})) {
 258             $found = 1;
 259             last;
 260         }
 261     };
 262
 263     return 1 if $found;
 264
 265     return undef if $noerr;
 266
 267     raise_perm_exc("$path, " . join("|", @$privs));
 268 };
 269
 270 sub check_full {
 271     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 272     if ($any) {
 273         return $self->check_any($username, $path, $privs, $noerr);
 274     } else {
 275         return $self->check($username, $path, $privs, $noerr);
 276     }
 277 }
 278
 279 sub check_user_enabled {
 280     my ($self, $user, $noerr) = @_;
 281
 282     my $cfg = $self->{user_cfg};
 283     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 284 }
 285
 286 sub check_user_exist {
 287     my ($self, $user, $noerr) = @_;
 288
 289     my $cfg = $self->{user_cfg};
 290     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 291 }
 292
 293 sub check_pool_exist {
 294     my ($self, $pool, $noerr) = @_;
 295
 296     my $cfg = $self->{user_cfg};
 297
 298     return 1 if $cfg->{pools}->{$pool};
 299
 300     return undef if $noerr;
 301
 302     raise_perm_exc("pool '$pool' does not exist");
 303 }
 304
 305 sub check_vm_perm {
 306     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 307
 308     my $cfg = $self->{user_cfg};
 309
 310     if ($pool) {
 311         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 312     }
 313     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 314 };
 315
 316 sub is_group_member {
 317     my ($self, $group, $user) = @_;
 318
 319     my $cfg = $self->{user_cfg};
 320
 321     return 0 if !$cfg->{groups}->{$group};
 322
 323     return defined($cfg->{groups}->{$group}->{users}->{$user});
 324 }
 325
 326 sub filter_groups {
 327     my ($self, $user, $privs, $any) = @_;
 328
 329     my $cfg = $self->{user_cfg};
 330
 331     my $groups = {};
 332     foreach my $group (keys %{$cfg->{groups}}) {
 333         my $path = "/access/groups/$group";
 334         if ($self->check_full($user, $path, $privs, $any, 1)) {
 335             $groups->{$group} = $cfg->{groups}->{$group};
 336         }
 337     }
 338
 339     return $groups;
 340 }
 341
 342 sub group_member_join {
 343     my ($self, $grouplist) = @_;
 344
 345     my $users = {};
 346
 347     my $cfg = $self->{user_cfg};
 348     foreach my $group (@$grouplist) {
 349         my $data = $cfg->{groups}->{$group};
 350         next if !$data;
 351         foreach my $user (keys %{$data->{users}}) {
 352             $users->{$user} = 1;
 353         }
 354     }
 355
 356     return $users;
 357 }
 358
 359 sub check_perm_modify {
 360     my ($self, $username, $path, $noerr) = @_;
 361
 362     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 363
 364     my $testperms = [ 'Permissions.Modify' ];
 365     if ($path =~ m|^/storage/.+$|) {
 366         push @$testperms, 'Datastore.Allocate';
 367     } elsif ($path =~ m|^/vms/.+$|) {
 368         push @$testperms, 'VM.Allocate';
 369     } elsif ($path =~ m|^/pool/.+$|) {
 370         push @$testperms, 'Pool.Allocate';
 371     }
 372
 373     return $self->check_any($username, $path, $testperms, $noerr);
 374 }
 375
 376 sub exec_api2_perm_check {
 377     my ($self, $check, $username, $param, $noerr) = @_;
 378
 379     # syslog("info", "CHECK " . join(', ', @$check));
 380
 381     my $ind = 0;
 382     my $test = $check->[$ind++];
 383     die "no permission test specified" if !$test;
 384
 385     if ($test eq 'and') {
 386         while (my $subcheck = $check->[$ind++]) {
 387             $self->exec_api2_perm_check($subcheck, $username, $param);
 388         }
 389         return 1;
 390     } elsif ($test eq 'or') {
 391         while (my $subcheck = $check->[$ind++]) {
 392             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 393         }
 394         return 0 if $noerr;
 395         raise_perm_exc();
 396     } elsif ($test eq 'perm') {
 397         my ($t, $tmplpath, $privs, %options) = @$check;
 398         my $any = $options{any};
 399         die "missing parameters" if !($tmplpath && $privs);
 400         my $require_param = $options{require_param};
 401         if ($require_param && !defined($param->{$require_param})) {
 402             return 0 if $noerr;
 403             raise_perm_exc();
 404         }
 405         my $path = PVE::Tools::template_replace($tmplpath, $param);
 406         $path = PVE::AccessControl::normalize_path($path);
 407         return $self->check_full($username, $path, $privs, $any, $noerr);
 408     } elsif ($test eq 'userid-group') {
 409         my $userid = $param->{userid};
 410         my ($t, $privs, %options) = @$check;
 411
 412         my $check_existing_user = !$options{groups_param} || $options{groups_param} ne 'create';
 413         return 0 if $check_existing_user && !$self->check_user_exist($userid, $noerr);
 414
 415         # check permission for ALL groups (and thus ALL users)
 416         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 417             # list of groups $username has any of $privs on
 418             my $groups = $self->filter_groups($username, $privs, 1);
 419             if ($options{groups_param}) {
 420                 # does $username have any of $privs on all new/updated/.. groups?
 421                 my @group_param = PVE::Tools::split_list($param->{groups});
 422                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 423                 foreach my $pg (@group_param) {
 424                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 425                         if !$groups->{$pg};
 426                 }
 427             }
 428             if ($check_existing_user) {
 429                 # does $username have any of $privs on any existing group of $userid
 430                 my $allowed_users = $self->group_member_join([keys %$groups]);
 431                 if (!$allowed_users->{$userid}) {
 432                     return 0 if $noerr;
 433                     raise_perm_exc();
 434                 }
 435             }
 436         }
 437         return 1;
 438     } elsif ($test eq 'userid-param') {
 439         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 440         my ($t, $subtest) = @$check;
 441         die "missing parameters" if !$subtest;
 442         if ($subtest eq 'self') {
 443             return 0 if !$self->check_user_exist($userid, $noerr);
 444             return 1 if $username eq $userid;
 445             return 0 if $noerr;
 446             raise_perm_exc();
 447         } elsif ($subtest eq 'Realm.AllocateUser') {
 448             my $path =  "/access/realm/$realm";
 449             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 450         } else {
 451             die "unknown userid-param test";
 452         }
 453      } elsif ($test eq 'perm-modify') {
 454         my ($t, $tmplpath) = @$check;
 455         my $path = PVE::Tools::template_replace($tmplpath, $param);
 456         $path = PVE::AccessControl::normalize_path($path);
 457         return $self->check_perm_modify($username, $path, $noerr);
 458    } else {
 459         die "unknown permission test";
 460     }
 461 };
 462
 463 sub check_api2_permissions {
 464     my ($self, $perm, $username, $param) = @_;
 465
 466     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 467
 468     raise_perm_exc("user != null") if !$username;
 469
 470     return 1 if $username eq 'root@pam';
 471
 472     raise_perm_exc('user != root@pam') if !$perm;
 473
 474     return 1 if $perm->{user} && $perm->{user} eq 'all';
 475
 476     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 477         if $perm->{check};
 478
 479     raise_perm_exc();
 480 }
 481
 482 sub log_cluster_msg {
 483     my ($self, $pri, $user, $msg) = @_;
 484
 485     PVE::Cluster::log_msg($pri, $user, $msg);
 486 }
 487
 488 sub broadcast_tasklist {
 489     my ($self, $tlist) = @_;
 490
 491     PVE::Cluster::broadcast_tasklist($tlist);
 492 }
 493
 494 # initialize environment - must be called once at program startup
 495 sub init {
 496     my ($class, $type, %params) = @_;
 497
 498     $class = ref($class) || $class;
 499
 500     my $self = $class->SUPER::init($type, %params);
 501
 502     $self->{user_cfg} = {};
 503     $self->{aclcache} = {};
 504     $self->{aclversion} = undef;
 505
 506     return $self;
 507 };
 508
 509
 510 # init_request - must be called before each RPC request
 511 sub init_request {
 512     my ($self, %params) = @_;
 513
 514     PVE::Cluster::cfs_update();
 515
 516     $self->{result_attributes} = {};
 517
 518     my $userconfig; # we use this for regression tests
 519     foreach my $p (keys %params) {
 520         if ($p eq 'userconfig') {
 521             $userconfig = $params{$p};
 522         } else {
 523             die "unknown parameter '$p'";
 524         }
 525     }
 526
 527     eval {
 528         $self->{aclcache} = {};
 529         if ($userconfig) {
 530             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 531             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 532             $self->{user_cfg} = $cfg;
 533         } else {
 534             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 535             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 536                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 537                 $self->{aclversion} = $ucvers;
 538                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 539                 $self->{user_cfg} = $cfg;
 540             }
 541         }
 542     };
 543     if (my $err = $@) {
 544         $self->{user_cfg} = {};
 545         die "Unable to load access control list: $err";
 546     }
 547 }
 548
 549 # hacks: to provide better backwards compatibiliy
 550
 551 # old code uses PVE::RPCEnvironment::get();
 552 # new code should use PVE::RPCEnvironment->get();
 553 sub get {
 554     return PVE::RESTEnvironment->get();
 555 }
 556
 557 # old code uses PVE::RPCEnvironment::is_worker();
 558 # new code should use PVE::RPCEnvironment->is_worker();
 559 sub is_worker {
 560     return PVE::RESTEnvironment->is_worker();
 561 }
 562
 563 1;