src/PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AccessControl;
   7 use PVE::Cluster;
   8 use PVE::Exception qw(raise raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::ProcFSTools;
  11 use PVE::RESTEnvironment;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools;
  14
  15 use base qw(PVE::RESTEnvironment);
  16
  17 # ACL cache
  18
  19 my $compile_acl_path = sub {
  20     my ($self, $user, $path) = @_;
  21
  22     my $cfg = $self->{user_cfg};
  23
  24     return undef if !$cfg->{roles};
  25
  26     die "internal error" if $user eq 'root@pam';
  27
  28     my $cache = $self->{aclcache};
  29     $cache->{$user} = {} if !$cache->{$user};
  30     my $data = $cache->{$user};
  31
  32     my ($username, undef) = PVE::AccessControl::split_tokenid($user, 1);
  33     die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
  34
  35     if (!$data->{poolroles}) {
  36         $data->{poolroles} = {};
  37
  38         foreach my $pool (keys %{$cfg->{pools}}) {
  39             my $d = $cfg->{pools}->{$pool};
  40             my $pool_roles = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  41             next if !scalar(keys %$pool_roles);
  42             foreach my $vmid (keys %{$d->{vms}}) {
  43                 for my $role (keys %$pool_roles) {
  44                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  45                 }
  46             }
  47             foreach my $storeid (keys %{$d->{storage}}) {
  48                 for my $role (keys %$pool_roles) {
  49                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  50                 }
  51             }
  52         }
  53     }
  54
  55     my $roles = PVE::AccessControl::roles($cfg, $user, $path);
  56
  57     # apply roles inherited from pools
  58     # Note: assume we do not want to propagate those privs
  59     if ($data->{poolroles}->{$path}) {
  60         if (!defined($roles->{NoAccess})) {
  61             if ($data->{poolroles}->{$path}->{NoAccess}) {
  62                 $roles = { 'NoAccess' => 0 };
  63             } else {
  64                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  65                     $roles->{$role} = 0 if !defined($roles->{$role});
  66                 }
  67             }
  68         }
  69     }
  70
  71     $data->{roles}->{$path} = $roles;
  72
  73     my $privs = {};
  74     foreach my $role (keys %$roles) {
  75         if (my $privset = $cfg->{roles}->{$role}) {
  76             foreach my $p (keys %$privset) {
  77                 $privs->{$p} = $roles->{$role};
  78             }
  79         }
  80     }
  81
  82     if ($username && $username ne 'root@pam') {
  83         # intersect user and token permissions
  84         my $user_privs = $cache->{$username}->{privs}->{$path};
  85         $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } keys %$privs };
  86     }
  87
  88     $data->{privs}->{$path} = $privs;
  89
  90     return $privs;
  91 };
  92
  93 sub permissions {
  94     my ($self, $user, $path) = @_;
  95
  96     if ($user eq 'root@pam') { # root can do anything
  97         my $cfg = $self->{user_cfg};
  98         return { map { $_ => 1 } keys %{$cfg->{roles}->{'Administrator'}} };
  99     }
 100
 101     if (PVE::AccessControl::pve_verify_tokenid($user, 1)) {
 102         my ($username, $token) = PVE::AccessControl::split_tokenid($user);
 103         my $cfg = $self->{user_cfg};
 104         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
 105
 106         return {} if !$token_info;
 107
 108         # ensure cache for user is populated
 109         my $user_perms = $self->permissions($username, $path);
 110
 111         # return user privs for non-privsep tokens
 112         return $user_perms if !$token_info->{privsep};
 113     } else {
 114         $user = PVE::AccessControl::verify_username($user, 1);
 115         return {} if !$user;
 116     }
 117
 118     my $cache = $self->{aclcache};
 119     $cache->{$user} = {} if !$cache->{$user};
 120
 121     my $acl = $cache->{$user};
 122
 123     my $perm = $acl->{privs}->{$path};
 124     return $perm if $perm;
 125
 126     return &$compile_acl_path($self, $user, $path);
 127 }
 128
 129 sub get_effective_permissions {
 130     my ($self, $user) = @_;
 131
 132     # default / top level paths
 133     my $paths = {
 134         '/' => 1,
 135         '/access' => 1,
 136         '/access/groups' => 1,
 137         '/nodes' => 1,
 138         '/pools' => 1,
 139         '/storage' => 1,
 140         '/vms' => 1,
 141     };
 142
 143     my $cfg = $self->{user_cfg};
 144
 145     # paths explicitly listed in ACLs
 146     foreach my $acl_path (keys %{$cfg->{acl}}) {
 147         $paths->{$acl_path} = 1;
 148     }
 149
 150     # paths referenced by pool definitions
 151     foreach my $pool (keys %{$cfg->{pools}}) {
 152         my $d = $cfg->{pools}->{$pool};
 153         foreach my $vmid (keys %{$d->{vms}}) {
 154             $paths->{"/vms/$vmid"} = 1;
 155         }
 156         foreach my $storeid (keys %{$d->{storage}}) {
 157             $paths->{"/storage/$storeid"} = 1;
 158         }
 159     }
 160
 161     my $perms = {};
 162     foreach my $path (keys %$paths) {
 163         my $path_perms = $self->permissions($user, $path);
 164         # filter paths where user has NO permissions
 165         $perms->{$path} = $path_perms if %$path_perms;
 166     }
 167     return $perms;
 168 }
 169
 170 sub check {
 171     my ($self, $user, $path, $privs, $noerr) = @_;
 172
 173     my $perm = $self->permissions($user, $path);
 174
 175     foreach my $priv (@$privs) {
 176         PVE::AccessControl::verify_privname($priv);
 177         if (!defined($perm->{$priv})) {
 178             return undef if $noerr;
 179             raise_perm_exc("$path, $priv");
 180         }
 181     };
 182
 183     return 1;
 184 };
 185
 186 sub check_any {
 187     my ($self, $user, $path, $privs, $noerr) = @_;
 188
 189     my $perm = $self->permissions($user, $path);
 190
 191     my $found = 0;
 192     foreach my $priv (@$privs) {
 193         PVE::AccessControl::verify_privname($priv);
 194         if (defined($perm->{$priv})) {
 195             $found = 1;
 196             last;
 197         }
 198     };
 199
 200     return 1 if $found;
 201
 202     return undef if $noerr;
 203
 204     raise_perm_exc("$path, " . join("|", @$privs));
 205 };
 206
 207 sub check_full {
 208     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 209     if ($any) {
 210         return $self->check_any($username, $path, $privs, $noerr);
 211     } else {
 212         return $self->check($username, $path, $privs, $noerr);
 213     }
 214 }
 215
 216 sub check_user_enabled {
 217     my ($self, $user, $noerr) = @_;
 218
 219     my $cfg = $self->{user_cfg};
 220     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 221 }
 222
 223 sub check_user_exist {
 224     my ($self, $user, $noerr) = @_;
 225
 226     my $cfg = $self->{user_cfg};
 227     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 228 }
 229
 230 sub check_pool_exist {
 231     my ($self, $pool, $noerr) = @_;
 232
 233     my $cfg = $self->{user_cfg};
 234
 235     return 1 if $cfg->{pools}->{$pool};
 236
 237     return undef if $noerr;
 238
 239     raise_perm_exc("pool '$pool' does not exist");
 240 }
 241
 242 sub check_vm_perm {
 243     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 244
 245     my $cfg = $self->{user_cfg};
 246
 247     if ($pool) {
 248         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 249     }
 250     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 251 };
 252
 253 sub is_group_member {
 254     my ($self, $group, $user) = @_;
 255
 256     my $cfg = $self->{user_cfg};
 257
 258     return 0 if !$cfg->{groups}->{$group};
 259
 260     return defined($cfg->{groups}->{$group}->{users}->{$user});
 261 }
 262
 263 sub filter_groups {
 264     my ($self, $user, $privs, $any) = @_;
 265
 266     my $cfg = $self->{user_cfg};
 267
 268     my $groups = {};
 269     foreach my $group (keys %{$cfg->{groups}}) {
 270         my $path = "/access/groups/$group";
 271         if ($self->check_full($user, $path, $privs, $any, 1)) {
 272             $groups->{$group} = $cfg->{groups}->{$group};
 273         }
 274     }
 275
 276     return $groups;
 277 }
 278
 279 sub group_member_join {
 280     my ($self, $grouplist) = @_;
 281
 282     my $users = {};
 283
 284     my $cfg = $self->{user_cfg};
 285     foreach my $group (@$grouplist) {
 286         my $data = $cfg->{groups}->{$group};
 287         next if !$data;
 288         foreach my $user (keys %{$data->{users}}) {
 289             $users->{$user} = 1;
 290         }
 291     }
 292
 293     return $users;
 294 }
 295
 296 sub check_perm_modify {
 297     my ($self, $username, $path, $noerr) = @_;
 298
 299     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 300
 301     my $testperms = [ 'Permissions.Modify' ];
 302     if ($path =~ m|^/storage/.+$|) {
 303         push @$testperms, 'Datastore.Allocate';
 304     } elsif ($path =~ m|^/vms/.+$|) {
 305         push @$testperms, 'VM.Allocate';
 306     } elsif ($path =~ m|^/pool/.+$|) {
 307         push @$testperms, 'Pool.Allocate';
 308     }
 309
 310     return $self->check_any($username, $path, $testperms, $noerr);
 311 }
 312
 313 sub exec_api2_perm_check {
 314     my ($self, $check, $username, $param, $noerr) = @_;
 315
 316     # syslog("info", "CHECK " . join(', ', @$check));
 317
 318     my $ind = 0;
 319     my $test = $check->[$ind++];
 320     die "no permission test specified" if !$test;
 321
 322     if ($test eq 'and') {
 323         while (my $subcheck = $check->[$ind++]) {
 324             $self->exec_api2_perm_check($subcheck, $username, $param);
 325         }
 326         return 1;
 327     } elsif ($test eq 'or') {
 328         while (my $subcheck = $check->[$ind++]) {
 329             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 330         }
 331         return 0 if $noerr;
 332         raise_perm_exc();
 333     } elsif ($test eq 'perm') {
 334         my ($t, $tmplpath, $privs, %options) = @$check;
 335         my $any = $options{any};
 336         die "missing parameters" if !($tmplpath && $privs);
 337         my $require_param = $options{require_param};
 338         if ($require_param && !defined($param->{$require_param})) {
 339             return 0 if $noerr;
 340             raise_perm_exc();
 341         }
 342         my $path = PVE::Tools::template_replace($tmplpath, $param);
 343         $path = PVE::AccessControl::normalize_path($path);
 344         return $self->check_full($username, $path, $privs, $any, $noerr);
 345     } elsif ($test eq 'userid-group') {
 346         my $userid = $param->{userid};
 347         my ($t, $privs, %options) = @$check;
 348         return 0 if !$options{groups_param} && !$self->check_user_exist($userid, $noerr);
 349         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 350             my $groups = $self->filter_groups($username, $privs, 1);
 351             if ($options{groups_param}) {
 352                 my @group_param = PVE::Tools::split_list($param->{groups});
 353                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 354                 foreach my $pg (@group_param) {
 355                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 356                         if !$groups->{$pg};
 357                 }
 358             } else {
 359                 my $allowed_users = $self->group_member_join([keys %$groups]);
 360                 if (!$allowed_users->{$userid}) {
 361                     return 0 if $noerr;
 362                     raise_perm_exc();
 363                 }
 364             }
 365         }
 366         return 1;
 367     } elsif ($test eq 'userid-param') {
 368         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 369         my ($t, $subtest) = @$check;
 370         die "missing parameters" if !$subtest;
 371         if ($subtest eq 'self') {
 372             return 0 if !$self->check_user_exist($userid, $noerr);
 373             return 1 if $username eq $userid;
 374             return 0 if $noerr;
 375             raise_perm_exc();
 376         } elsif ($subtest eq 'Realm.AllocateUser') {
 377             my $path =  "/access/realm/$realm";
 378             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 379         } else {
 380             die "unknown userid-param test";
 381         }
 382      } elsif ($test eq 'perm-modify') {
 383         my ($t, $tmplpath) = @$check;
 384         my $path = PVE::Tools::template_replace($tmplpath, $param);
 385         $path = PVE::AccessControl::normalize_path($path);
 386         return $self->check_perm_modify($username, $path, $noerr);
 387    } else {
 388         die "unknown permission test";
 389     }
 390 };
 391
 392 sub check_api2_permissions {
 393     my ($self, $perm, $username, $param) = @_;
 394
 395     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 396
 397     raise_perm_exc("user != null") if !$username;
 398
 399     return 1 if $username eq 'root@pam';
 400
 401     raise_perm_exc('user != root@pam') if !$perm;
 402
 403     return 1 if $perm->{user} && $perm->{user} eq 'all';
 404
 405     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 406         if $perm->{check};
 407
 408     raise_perm_exc();
 409 }
 410
 411 sub log_cluster_msg {
 412     my ($self, $pri, $user, $msg) = @_;
 413
 414     PVE::Cluster::log_msg($pri, $user, $msg);
 415 }
 416
 417 sub broadcast_tasklist {
 418     my ($self, $tlist) = @_;
 419
 420     PVE::Cluster::broadcast_tasklist($tlist);
 421 }
 422
 423 # initialize environment - must be called once at program startup
 424 sub init {
 425     my ($class, $type, %params) = @_;
 426
 427     $class = ref($class) || $class;
 428
 429     my $self = $class->SUPER::init($type, %params);
 430
 431     $self->{user_cfg} = {};
 432     $self->{aclcache} = {};
 433     $self->{aclversion} = undef;
 434
 435     return $self;
 436 };
 437
 438
 439 # init_request - must be called before each RPC request
 440 sub init_request {
 441     my ($self, %params) = @_;
 442
 443     PVE::Cluster::cfs_update();
 444
 445     $self->{result_attributes} = {};
 446
 447     my $userconfig; # we use this for regression tests
 448     foreach my $p (keys %params) {
 449         if ($p eq 'userconfig') {
 450             $userconfig = $params{$p};
 451         } else {
 452             die "unknown parameter '$p'";
 453         }
 454     }
 455
 456     eval {
 457         $self->{aclcache} = {};
 458         if ($userconfig) {
 459             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 460             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 461             $self->{user_cfg} = $cfg;
 462         } else {
 463             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 464             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 465                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 466                 $self->{aclversion} = $ucvers;
 467                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 468                 $self->{user_cfg} = $cfg;
 469             }
 470         }
 471     };
 472     if (my $err = $@) {
 473         $self->{user_cfg} = {};
 474         die "Unable to load access control list: $err";
 475     }
 476 }
 477
 478 # hacks: to provide better backwards compatibiliy
 479
 480 # old code uses PVE::RPCEnvironment::get();
 481 # new code should use PVE::RPCEnvironment->get();
 482 sub get {
 483     return PVE::RESTEnvironment->get();
 484 }
 485
 486 # old code uses PVE::RPCEnvironment::is_worker();
 487 # new code should use PVE::RPCEnvironment->is_worker();
 488 sub is_worker {
 489     return PVE::RESTEnvironment->is_worker();
 490 }
 491
 492 1;