1 package PVE
::RPCEnvironment
;
6 use PVE
::AccessControl
;
8 use PVE
::Exception
qw(raise raise_perm_exc);
11 use PVE
::RESTEnvironment
;
15 use base
qw(PVE::RESTEnvironment);
19 my $compile_acl_path = sub {
20 my ($self, $user, $path) = @_;
22 my $cfg = $self->{user_cfg
};
24 return undef if !$cfg->{roles
};
26 die "internal error" if $user eq 'root@pam';
28 my $cache = $self->{aclcache
};
29 $cache->{$user} = {} if !$cache->{$user};
30 my $data = $cache->{$user};
32 my ($username, undef) = PVE
::AccessControl
::split_tokenid
($user, 1);
33 die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
35 if (!$data->{poolroles
}) {
36 $data->{poolroles
} = {};
38 foreach my $pool (keys %{$cfg->{pools
}}) {
39 my $d = $cfg->{pools
}->{$pool};
40 my $pool_roles = PVE
::AccessControl
::roles
($cfg, $user, "/pool/$pool"); # pool roles
41 next if !scalar(keys %$pool_roles);
42 foreach my $vmid (keys %{$d->{vms
}}) {
43 for my $role (keys %$pool_roles) {
44 $data->{poolroles
}->{"/vms/$vmid"}->{$role} = 1;
47 foreach my $storeid (keys %{$d->{storage
}}) {
48 for my $role (keys %$pool_roles) {
49 $data->{poolroles
}->{"/storage/$storeid"}->{$role} = 1;
55 my $roles = PVE
::AccessControl
::roles
($cfg, $user, $path);
57 # apply roles inherited from pools
58 # Note: assume we do not want to propagate those privs
59 if ($data->{poolroles
}->{$path}) {
60 if (!defined($roles->{NoAccess
})) {
61 if ($data->{poolroles
}->{$path}->{NoAccess
}) {
62 $roles = { 'NoAccess' => 0 };
64 foreach my $role (keys %{$data->{poolroles
}->{$path}}) {
65 $roles->{$role} = 0 if !defined($roles->{$role});
71 $data->{roles
}->{$path} = $roles;
74 foreach my $role (keys %$roles) {
75 if (my $privset = $cfg->{roles
}->{$role}) {
76 foreach my $p (keys %$privset) {
77 $privs->{$p} = $roles->{$role};
82 if ($username && $username ne 'root@pam') {
83 # intersect user and token permissions
84 my $user_privs = $cache->{$username}->{privs
}->{$path};
85 $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } keys %$privs };
88 $data->{privs
}->{$path} = $privs;
94 my ($self, $user, $path) = @_;
96 if ($user eq 'root@pam') { # root can do anything
97 my $cfg = $self->{user_cfg
};
98 return { map { $_ => 1 } keys %{$cfg->{roles
}->{'Administrator'}} };
101 if (PVE
::AccessControl
::pve_verify_tokenid
($user, 1)) {
102 my ($username, $token) = PVE
::AccessControl
::split_tokenid
($user);
103 my $cfg = $self->{user_cfg
};
104 my $token_info = $cfg->{users
}->{$username}->{tokens
}->{$token};
106 return {} if !$token_info;
108 # ensure cache for user is populated
109 my $user_perms = $self->permissions($username, $path);
111 # return user privs for non-privsep tokens
112 return $user_perms if !$token_info->{privsep
};
114 $user = PVE
::AccessControl
::verify_username
($user, 1);
118 my $cache = $self->{aclcache
};
119 $cache->{$user} = {} if !$cache->{$user};
121 my $acl = $cache->{$user};
123 my $perm = $acl->{privs
}->{$path};
124 return $perm if $perm;
126 return &$compile_acl_path($self, $user, $path);
129 sub compute_api_permission
{
130 my ($self, $authuser) = @_;
132 my $usercfg = $self->{user_cfg
};
136 vms
=> qr/VM\.|Permissions\.Modify/,
137 access
=> qr/(User|Group)\.|Permissions\.Modify/,
138 storage
=> qr/Datastore\.|Permissions\.Modify/,
139 nodes
=> qr/Sys\.|Permissions\.Modify/,
140 sdn
=> qr/SDN\.|Permissions\.Modify/,
141 dc
=> qr/Sys\.Audit|SDN\./,
143 map { $res->{$_} = {} } keys %$priv_re_map;
145 my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage', '/sdn'];
147 my $checked_paths = {};
148 foreach my $path (@$required_paths, keys %{$usercfg->{acl
}}) {
149 next if $checked_paths->{$path};
150 $checked_paths->{$path} = 1;
152 my $path_perm = $self->permissions($authuser, $path);
154 my $toplevel = ($path =~ /^\/(\w
+)/) ?
$1 : 'dc';
155 if ($toplevel eq 'pool') {
156 foreach my $priv (keys %$path_perm) {
157 if ($priv =~ m/^VM\./) {
158 $res->{vms
}->{$priv} = 1;
159 } elsif ($priv =~ m/^Datastore\./) {
160 $res->{storage
}->{$priv} = 1;
161 } elsif ($priv eq 'Permissions.Modify') {
162 $res->{storage
}->{$priv} = 1;
163 $res->{vms
}->{$priv} = 1;
167 my $priv_regex = $priv_re_map->{$toplevel} // next;
168 foreach my $priv (keys %$path_perm) {
169 next if $priv !~ m/^($priv_regex)/;
170 $res->{$toplevel}->{$priv} = 1;
178 sub get_effective_permissions
{
179 my ($self, $user) = @_;
181 # default / top level paths
185 '/access/groups' => 1,
192 my $cfg = $self->{user_cfg
};
194 # paths explicitly listed in ACLs
195 foreach my $acl_path (keys %{$cfg->{acl
}}) {
196 $paths->{$acl_path} = 1;
199 # paths referenced by pool definitions
200 foreach my $pool (keys %{$cfg->{pools
}}) {
201 my $d = $cfg->{pools
}->{$pool};
202 foreach my $vmid (keys %{$d->{vms
}}) {
203 $paths->{"/vms/$vmid"} = 1;
205 foreach my $storeid (keys %{$d->{storage
}}) {
206 $paths->{"/storage/$storeid"} = 1;
211 foreach my $path (keys %$paths) {
212 my $path_perms = $self->permissions($user, $path);
213 # filter paths where user has NO permissions
214 $perms->{$path} = $path_perms if %$path_perms;
220 my ($self, $user, $path, $privs, $noerr) = @_;
222 my $perm = $self->permissions($user, $path);
224 foreach my $priv (@$privs) {
225 PVE
::AccessControl
::verify_privname
($priv);
226 if (!defined($perm->{$priv})) {
227 return undef if $noerr;
228 raise_perm_exc
("$path, $priv");
236 my ($self, $user, $path, $privs, $noerr) = @_;
238 my $perm = $self->permissions($user, $path);
241 foreach my $priv (@$privs) {
242 PVE
::AccessControl
::verify_privname
($priv);
243 if (defined($perm->{$priv})) {
251 return undef if $noerr;
253 raise_perm_exc
("$path, " . join("|", @$privs));
257 my ($self, $username, $path, $privs, $any, $noerr) = @_;
259 return $self->check_any($username, $path, $privs, $noerr);
261 return $self->check($username, $path, $privs, $noerr);
265 sub check_user_enabled
{
266 my ($self, $user, $noerr) = @_;
268 my $cfg = $self->{user_cfg
};
269 return PVE
::AccessControl
::check_user_enabled
($cfg, $user, $noerr);
272 sub check_user_exist
{
273 my ($self, $user, $noerr) = @_;
275 my $cfg = $self->{user_cfg
};
276 return PVE
::AccessControl
::check_user_exist
($cfg, $user, $noerr);
279 sub check_pool_exist
{
280 my ($self, $pool, $noerr) = @_;
282 my $cfg = $self->{user_cfg
};
284 return 1 if $cfg->{pools
}->{$pool};
286 return undef if $noerr;
288 raise_perm_exc
("pool '$pool' does not exist");
292 my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
294 my $cfg = $self->{user_cfg
};
297 return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
299 return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
302 sub is_group_member
{
303 my ($self, $group, $user) = @_;
305 my $cfg = $self->{user_cfg
};
307 return 0 if !$cfg->{groups
}->{$group};
309 return defined($cfg->{groups
}->{$group}->{users
}->{$user});
313 my ($self, $user, $privs, $any) = @_;
315 my $cfg = $self->{user_cfg
};
318 foreach my $group (keys %{$cfg->{groups
}}) {
319 my $path = "/access/groups/$group";
320 if ($self->check_full($user, $path, $privs, $any, 1)) {
321 $groups->{$group} = $cfg->{groups
}->{$group};
328 sub group_member_join
{
329 my ($self, $grouplist) = @_;
333 my $cfg = $self->{user_cfg
};
334 foreach my $group (@$grouplist) {
335 my $data = $cfg->{groups
}->{$group};
337 foreach my $user (keys %{$data->{users
}}) {
345 sub check_perm_modify
{
346 my ($self, $username, $path, $noerr) = @_;
348 return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
350 my $testperms = [ 'Permissions.Modify' ];
351 if ($path =~ m
|^/storage/.+$|) {
352 push @$testperms, 'Datastore.Allocate';
353 } elsif ($path =~ m
|^/vms/.+$|) {
354 push @$testperms, 'VM.Allocate';
355 } elsif ($path =~ m
|^/pool/.+$|) {
356 push @$testperms, 'Pool.Allocate';
359 return $self->check_any($username, $path, $testperms, $noerr);
362 sub exec_api2_perm_check
{
363 my ($self, $check, $username, $param, $noerr) = @_;
365 # syslog("info", "CHECK " . join(', ', @$check));
368 my $test = $check->[$ind++];
369 die "no permission test specified" if !$test;
371 if ($test eq 'and') {
372 while (my $subcheck = $check->[$ind++]) {
373 $self->exec_api2_perm_check($subcheck, $username, $param);
376 } elsif ($test eq 'or') {
377 while (my $subcheck = $check->[$ind++]) {
378 return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
382 } elsif ($test eq 'perm') {
383 my ($t, $tmplpath, $privs, %options) = @$check;
384 my $any = $options{any
};
385 die "missing parameters" if !($tmplpath && $privs);
386 my $require_param = $options{require_param
};
387 if ($require_param && !defined($param->{$require_param})) {
391 my $path = PVE
::Tools
::template_replace
($tmplpath, $param);
392 $path = PVE
::AccessControl
::normalize_path
($path);
393 return $self->check_full($username, $path, $privs, $any, $noerr);
394 } elsif ($test eq 'userid-group') {
395 my $userid = $param->{userid
};
396 my ($t, $privs, %options) = @$check;
397 return 0 if !$options{groups_param
} && !$self->check_user_exist($userid, $noerr);
398 if (!$self->check_any($username, "/access/groups", $privs, 1)) {
399 my $groups = $self->filter_groups($username, $privs, 1);
400 if ($options{groups_param
}) {
401 my @group_param = PVE
::Tools
::split_list
($param->{groups
});
402 raise_perm_exc
("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
403 foreach my $pg (@group_param) {
404 raise_perm_exc
("/access/groups/$pg, " . join("|", @$privs))
408 my $allowed_users = $self->group_member_join([keys %$groups]);
409 if (!$allowed_users->{$userid}) {
416 } elsif ($test eq 'userid-param') {
417 my ($userid, undef, $realm) = PVE
::AccessControl
::verify_username
($param->{userid
});
418 my ($t, $subtest) = @$check;
419 die "missing parameters" if !$subtest;
420 if ($subtest eq 'self') {
421 return 0 if !$self->check_user_exist($userid, $noerr);
422 return 1 if $username eq $userid;
425 } elsif ($subtest eq 'Realm.AllocateUser') {
426 my $path = "/access/realm/$realm";
427 return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
429 die "unknown userid-param test";
431 } elsif ($test eq 'perm-modify') {
432 my ($t, $tmplpath) = @$check;
433 my $path = PVE
::Tools
::template_replace
($tmplpath, $param);
434 $path = PVE
::AccessControl
::normalize_path
($path);
435 return $self->check_perm_modify($username, $path, $noerr);
437 die "unknown permission test";
441 sub check_api2_permissions
{
442 my ($self, $perm, $username, $param) = @_;
444 return 1 if !$username && $perm->{user
} && $perm->{user
} eq 'world';
446 raise_perm_exc
("user != null") if !$username;
448 return 1 if $username eq 'root@pam';
450 raise_perm_exc
('user != root@pam') if !$perm;
452 return 1 if $perm->{user
} && $perm->{user
} eq 'all';
454 return $self->exec_api2_perm_check($perm->{check
}, $username, $param)
460 sub log_cluster_msg
{
461 my ($self, $pri, $user, $msg) = @_;
463 PVE
::Cluster
::log_msg
($pri, $user, $msg);
466 sub broadcast_tasklist
{
467 my ($self, $tlist) = @_;
469 PVE
::Cluster
::broadcast_tasklist
($tlist);
472 # initialize environment - must be called once at program startup
474 my ($class, $type, %params) = @_;
476 $class = ref($class) || $class;
478 my $self = $class->SUPER::init
($type, %params);
480 $self->{user_cfg
} = {};
481 $self->{aclcache
} = {};
482 $self->{aclversion
} = undef;
488 # init_request - must be called before each RPC request
490 my ($self, %params) = @_;
492 PVE
::Cluster
::cfs_update
();
494 $self->{result_attributes
} = {};
496 my $userconfig; # we use this for regression tests
497 foreach my $p (keys %params) {
498 if ($p eq 'userconfig') {
499 $userconfig = $params{$p};
501 die "unknown parameter '$p'";
506 $self->{aclcache
} = {};
508 my $ucdata = PVE
::Tools
::file_get_contents
($userconfig);
509 my $cfg = PVE
::AccessControl
::parse_user_config
($userconfig, $ucdata);
510 $self->{user_cfg
} = $cfg;
512 my $ucvers = PVE
::Cluster
::cfs_file_version
('user.cfg');
513 if (!$self->{aclcache
} || !defined($self->{aclversion
}) ||
514 !defined($ucvers) || ($ucvers ne $self->{aclversion
})) {
515 $self->{aclversion
} = $ucvers;
516 my $cfg = PVE
::Cluster
::cfs_read_file
('user.cfg');
517 $self->{user_cfg
} = $cfg;
522 $self->{user_cfg
} = {};
523 die "Unable to load access control list: $err";
527 # hacks: to provide better backwards compatibiliy
529 # old code uses PVE::RPCEnvironment::get();
530 # new code should use PVE::RPCEnvironment->get();
532 return PVE
::RESTEnvironment-
>get();
535 # old code uses PVE::RPCEnvironment::is_worker();
536 # new code should use PVE::RPCEnvironment->is_worker();
538 return PVE
::RESTEnvironment-
>is_worker();