src/PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AccessControl;
   7 use PVE::Cluster;
   8 use PVE::Exception qw(raise raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::ProcFSTools;
  11 use PVE::RESTEnvironment;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools;
  14
  15 use base qw(PVE::RESTEnvironment);
  16
  17 # ACL cache
  18
  19 my $compile_acl_path = sub {
  20     my ($self, $user, $path) = @_;
  21
  22     my $cfg = $self->{user_cfg};
  23
  24     return undef if !$cfg->{roles};
  25
  26     die "internal error" if $user eq 'root@pam';
  27
  28     my $cache = $self->{aclcache};
  29     $cache->{$user} = {} if !$cache->{$user};
  30     my $data = $cache->{$user};
  31
  32     my ($username, undef) = PVE::AccessControl::split_tokenid($user, 1);
  33     die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
  34
  35     if (!$data->{poolroles}) {
  36         $data->{poolroles} = {};
  37
  38         foreach my $pool (keys %{$cfg->{pools}}) {
  39             my $d = $cfg->{pools}->{$pool};
  40             my $pool_roles = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  41             next if !scalar(keys %$pool_roles);
  42             foreach my $vmid (keys %{$d->{vms}}) {
  43                 for my $role (keys %$pool_roles) {
  44                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  45                 }
  46             }
  47             foreach my $storeid (keys %{$d->{storage}}) {
  48                 for my $role (keys %$pool_roles) {
  49                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  50                 }
  51             }
  52         }
  53     }
  54
  55     my $roles = PVE::AccessControl::roles($cfg, $user, $path);
  56
  57     # apply roles inherited from pools
  58     # Note: assume we do not want to propagate those privs
  59     if ($data->{poolroles}->{$path}) {
  60         if (!defined($roles->{NoAccess})) {
  61             if ($data->{poolroles}->{$path}->{NoAccess}) {
  62                 $roles = { 'NoAccess' => 0 };
  63             } else {
  64                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  65                     $roles->{$role} = 0 if !defined($roles->{$role});
  66                 }
  67             }
  68         }
  69     }
  70
  71     $data->{roles}->{$path} = $roles;
  72
  73     my $privs = {};
  74     foreach my $role (keys %$roles) {
  75         if (my $privset = $cfg->{roles}->{$role}) {
  76             foreach my $p (keys %$privset) {
  77                 $privs->{$p} = $roles->{$role};
  78             }
  79         }
  80     }
  81
  82     if ($username && $username ne 'root@pam') {
  83         # intersect user and token permissions
  84         my $user_privs = $cache->{$username}->{privs}->{$path};
  85         $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } keys %$privs };
  86     }
  87
  88     $data->{privs}->{$path} = $privs;
  89
  90     return $privs;
  91 };
  92
  93 sub permissions {
  94     my ($self, $user, $path) = @_;
  95
  96     if ($user eq 'root@pam') { # root can do anything
  97         my $cfg = $self->{user_cfg};
  98         return { map { $_ => 1 } keys %{$cfg->{roles}->{'Administrator'}} };
  99     }
 100
 101     if (PVE::AccessControl::pve_verify_tokenid($user, 1)) {
 102         my ($username, $token) = PVE::AccessControl::split_tokenid($user);
 103         my $cfg = $self->{user_cfg};
 104         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
 105
 106         return {} if !$token_info;
 107
 108         # ensure cache for user is populated
 109         my $user_perms = $self->permissions($username, $path);
 110
 111         # return user privs for non-privsep tokens
 112         return $user_perms if !$token_info->{privsep};
 113     } else {
 114         $user = PVE::AccessControl::verify_username($user, 1);
 115         return {} if !$user;
 116     }
 117
 118     my $cache = $self->{aclcache};
 119     $cache->{$user} = {} if !$cache->{$user};
 120
 121     my $acl = $cache->{$user};
 122
 123     my $perm = $acl->{privs}->{$path};
 124     return $perm if $perm;
 125
 126     return &$compile_acl_path($self, $user, $path);
 127 }
 128
 129 sub compute_api_permission {
 130     my ($self, $authuser) = @_;
 131
 132     my $usercfg = $self->{user_cfg};
 133
 134     my $res = {};
 135     my $priv_re_map = {
 136         vms => qr/VM\.|Permissions\.Modify/,
 137         access => qr/(User|Group)\.|Permissions\.Modify/,
 138         storage => qr/Datastore\.|Permissions\.Modify/,
 139         nodes => qr/Sys\.|Permissions\.Modify/,
 140         sdn => qr/SDN\.|Permissions\.Modify/,
 141         dc => qr/Sys\.Audit|SDN\./,
 142     };
 143     map { $res->{$_} = {} } keys %$priv_re_map;
 144
 145     my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage', '/sdn'];
 146
 147     my $checked_paths = {};
 148     foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
 149         next if $checked_paths->{$path};
 150         $checked_paths->{$path} = 1;
 151
 152         my $path_perm = $self->permissions($authuser, $path);
 153
 154         my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
 155         if ($toplevel eq 'pool') {
 156             foreach my $priv (keys %$path_perm) {
 157                 if ($priv =~ m/^VM\./) {
 158                     $res->{vms}->{$priv} = 1;
 159                 } elsif ($priv =~ m/^Datastore\./) {
 160                     $res->{storage}->{$priv} = 1;
 161                 } elsif ($priv eq 'Permissions.Modify') {
 162                     $res->{storage}->{$priv} = 1;
 163                     $res->{vms}->{$priv} = 1;
 164                 }
 165             }
 166         } else {
 167             my $priv_regex = $priv_re_map->{$toplevel} // next;
 168             foreach my $priv (keys %$path_perm) {
 169                 next if $priv !~ m/^($priv_regex)/;
 170                 $res->{$toplevel}->{$priv} = 1;
 171             }
 172         }
 173     }
 174
 175     return $res;
 176 }
 177
 178 sub get_effective_permissions {
 179     my ($self, $user) = @_;
 180
 181     # default / top level paths
 182     my $paths = {
 183         '/' => 1,
 184         '/access' => 1,
 185         '/access/groups' => 1,
 186         '/nodes' => 1,
 187         '/pools' => 1,
 188         '/storage' => 1,
 189         '/vms' => 1,
 190     };
 191
 192     my $cfg = $self->{user_cfg};
 193
 194     # paths explicitly listed in ACLs
 195     foreach my $acl_path (keys %{$cfg->{acl}}) {
 196         $paths->{$acl_path} = 1;
 197     }
 198
 199     # paths referenced by pool definitions
 200     foreach my $pool (keys %{$cfg->{pools}}) {
 201         my $d = $cfg->{pools}->{$pool};
 202         foreach my $vmid (keys %{$d->{vms}}) {
 203             $paths->{"/vms/$vmid"} = 1;
 204         }
 205         foreach my $storeid (keys %{$d->{storage}}) {
 206             $paths->{"/storage/$storeid"} = 1;
 207         }
 208     }
 209
 210     my $perms = {};
 211     foreach my $path (keys %$paths) {
 212         my $path_perms = $self->permissions($user, $path);
 213         # filter paths where user has NO permissions
 214         $perms->{$path} = $path_perms if %$path_perms;
 215     }
 216     return $perms;
 217 }
 218
 219 sub check {
 220     my ($self, $user, $path, $privs, $noerr) = @_;
 221
 222     my $perm = $self->permissions($user, $path);
 223
 224     foreach my $priv (@$privs) {
 225         PVE::AccessControl::verify_privname($priv);
 226         if (!defined($perm->{$priv})) {
 227             return undef if $noerr;
 228             raise_perm_exc("$path, $priv");
 229         }
 230     };
 231
 232     return 1;
 233 };
 234
 235 sub check_any {
 236     my ($self, $user, $path, $privs, $noerr) = @_;
 237
 238     my $perm = $self->permissions($user, $path);
 239
 240     my $found = 0;
 241     foreach my $priv (@$privs) {
 242         PVE::AccessControl::verify_privname($priv);
 243         if (defined($perm->{$priv})) {
 244             $found = 1;
 245             last;
 246         }
 247     };
 248
 249     return 1 if $found;
 250
 251     return undef if $noerr;
 252
 253     raise_perm_exc("$path, " . join("|", @$privs));
 254 };
 255
 256 sub check_full {
 257     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 258     if ($any) {
 259         return $self->check_any($username, $path, $privs, $noerr);
 260     } else {
 261         return $self->check($username, $path, $privs, $noerr);
 262     }
 263 }
 264
 265 sub check_user_enabled {
 266     my ($self, $user, $noerr) = @_;
 267
 268     my $cfg = $self->{user_cfg};
 269     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 270 }
 271
 272 sub check_user_exist {
 273     my ($self, $user, $noerr) = @_;
 274
 275     my $cfg = $self->{user_cfg};
 276     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 277 }
 278
 279 sub check_pool_exist {
 280     my ($self, $pool, $noerr) = @_;
 281
 282     my $cfg = $self->{user_cfg};
 283
 284     return 1 if $cfg->{pools}->{$pool};
 285
 286     return undef if $noerr;
 287
 288     raise_perm_exc("pool '$pool' does not exist");
 289 }
 290
 291 sub check_vm_perm {
 292     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 293
 294     my $cfg = $self->{user_cfg};
 295
 296     if ($pool) {
 297         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 298     }
 299     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 300 };
 301
 302 sub is_group_member {
 303     my ($self, $group, $user) = @_;
 304
 305     my $cfg = $self->{user_cfg};
 306
 307     return 0 if !$cfg->{groups}->{$group};
 308
 309     return defined($cfg->{groups}->{$group}->{users}->{$user});
 310 }
 311
 312 sub filter_groups {
 313     my ($self, $user, $privs, $any) = @_;
 314
 315     my $cfg = $self->{user_cfg};
 316
 317     my $groups = {};
 318     foreach my $group (keys %{$cfg->{groups}}) {
 319         my $path = "/access/groups/$group";
 320         if ($self->check_full($user, $path, $privs, $any, 1)) {
 321             $groups->{$group} = $cfg->{groups}->{$group};
 322         }
 323     }
 324
 325     return $groups;
 326 }
 327
 328 sub group_member_join {
 329     my ($self, $grouplist) = @_;
 330
 331     my $users = {};
 332
 333     my $cfg = $self->{user_cfg};
 334     foreach my $group (@$grouplist) {
 335         my $data = $cfg->{groups}->{$group};
 336         next if !$data;
 337         foreach my $user (keys %{$data->{users}}) {
 338             $users->{$user} = 1;
 339         }
 340     }
 341
 342     return $users;
 343 }
 344
 345 sub check_perm_modify {
 346     my ($self, $username, $path, $noerr) = @_;
 347
 348     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 349
 350     my $testperms = [ 'Permissions.Modify' ];
 351     if ($path =~ m|^/storage/.+$|) {
 352         push @$testperms, 'Datastore.Allocate';
 353     } elsif ($path =~ m|^/vms/.+$|) {
 354         push @$testperms, 'VM.Allocate';
 355     } elsif ($path =~ m|^/pool/.+$|) {
 356         push @$testperms, 'Pool.Allocate';
 357     }
 358
 359     return $self->check_any($username, $path, $testperms, $noerr);
 360 }
 361
 362 sub exec_api2_perm_check {
 363     my ($self, $check, $username, $param, $noerr) = @_;
 364
 365     # syslog("info", "CHECK " . join(', ', @$check));
 366
 367     my $ind = 0;
 368     my $test = $check->[$ind++];
 369     die "no permission test specified" if !$test;
 370
 371     if ($test eq 'and') {
 372         while (my $subcheck = $check->[$ind++]) {
 373             $self->exec_api2_perm_check($subcheck, $username, $param);
 374         }
 375         return 1;
 376     } elsif ($test eq 'or') {
 377         while (my $subcheck = $check->[$ind++]) {
 378             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 379         }
 380         return 0 if $noerr;
 381         raise_perm_exc();
 382     } elsif ($test eq 'perm') {
 383         my ($t, $tmplpath, $privs, %options) = @$check;
 384         my $any = $options{any};
 385         die "missing parameters" if !($tmplpath && $privs);
 386         my $require_param = $options{require_param};
 387         if ($require_param && !defined($param->{$require_param})) {
 388             return 0 if $noerr;
 389             raise_perm_exc();
 390         }
 391         my $path = PVE::Tools::template_replace($tmplpath, $param);
 392         $path = PVE::AccessControl::normalize_path($path);
 393         return $self->check_full($username, $path, $privs, $any, $noerr);
 394     } elsif ($test eq 'userid-group') {
 395         my $userid = $param->{userid};
 396         my ($t, $privs, %options) = @$check;
 397         return 0 if !$options{groups_param} && !$self->check_user_exist($userid, $noerr);
 398         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 399             my $groups = $self->filter_groups($username, $privs, 1);
 400             if ($options{groups_param}) {
 401                 my @group_param = PVE::Tools::split_list($param->{groups});
 402                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 403                 foreach my $pg (@group_param) {
 404                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 405                         if !$groups->{$pg};
 406                 }
 407             } else {
 408                 my $allowed_users = $self->group_member_join([keys %$groups]);
 409                 if (!$allowed_users->{$userid}) {
 410                     return 0 if $noerr;
 411                     raise_perm_exc();
 412                 }
 413             }
 414         }
 415         return 1;
 416     } elsif ($test eq 'userid-param') {
 417         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 418         my ($t, $subtest) = @$check;
 419         die "missing parameters" if !$subtest;
 420         if ($subtest eq 'self') {
 421             return 0 if !$self->check_user_exist($userid, $noerr);
 422             return 1 if $username eq $userid;
 423             return 0 if $noerr;
 424             raise_perm_exc();
 425         } elsif ($subtest eq 'Realm.AllocateUser') {
 426             my $path =  "/access/realm/$realm";
 427             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 428         } else {
 429             die "unknown userid-param test";
 430         }
 431      } elsif ($test eq 'perm-modify') {
 432         my ($t, $tmplpath) = @$check;
 433         my $path = PVE::Tools::template_replace($tmplpath, $param);
 434         $path = PVE::AccessControl::normalize_path($path);
 435         return $self->check_perm_modify($username, $path, $noerr);
 436    } else {
 437         die "unknown permission test";
 438     }
 439 };
 440
 441 sub check_api2_permissions {
 442     my ($self, $perm, $username, $param) = @_;
 443
 444     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 445
 446     raise_perm_exc("user != null") if !$username;
 447
 448     return 1 if $username eq 'root@pam';
 449
 450     raise_perm_exc('user != root@pam') if !$perm;
 451
 452     return 1 if $perm->{user} && $perm->{user} eq 'all';
 453
 454     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 455         if $perm->{check};
 456
 457     raise_perm_exc();
 458 }
 459
 460 sub log_cluster_msg {
 461     my ($self, $pri, $user, $msg) = @_;
 462
 463     PVE::Cluster::log_msg($pri, $user, $msg);
 464 }
 465
 466 sub broadcast_tasklist {
 467     my ($self, $tlist) = @_;
 468
 469     PVE::Cluster::broadcast_tasklist($tlist);
 470 }
 471
 472 # initialize environment - must be called once at program startup
 473 sub init {
 474     my ($class, $type, %params) = @_;
 475
 476     $class = ref($class) || $class;
 477
 478     my $self = $class->SUPER::init($type, %params);
 479
 480     $self->{user_cfg} = {};
 481     $self->{aclcache} = {};
 482     $self->{aclversion} = undef;
 483
 484     return $self;
 485 };
 486
 487
 488 # init_request - must be called before each RPC request
 489 sub init_request {
 490     my ($self, %params) = @_;
 491
 492     PVE::Cluster::cfs_update();
 493
 494     $self->{result_attributes} = {};
 495
 496     my $userconfig; # we use this for regression tests
 497     foreach my $p (keys %params) {
 498         if ($p eq 'userconfig') {
 499             $userconfig = $params{$p};
 500         } else {
 501             die "unknown parameter '$p'";
 502         }
 503     }
 504
 505     eval {
 506         $self->{aclcache} = {};
 507         if ($userconfig) {
 508             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 509             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 510             $self->{user_cfg} = $cfg;
 511         } else {
 512             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 513             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 514                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 515                 $self->{aclversion} = $ucvers;
 516                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 517                 $self->{user_cfg} = $cfg;
 518             }
 519         }
 520     };
 521     if (my $err = $@) {
 522         $self->{user_cfg} = {};
 523         die "Unable to load access control list: $err";
 524     }
 525 }
 526
 527 # hacks: to provide better backwards compatibiliy
 528
 529 # old code uses PVE::RPCEnvironment::get();
 530 # new code should use PVE::RPCEnvironment->get();
 531 sub get {
 532     return PVE::RESTEnvironment->get();
 533 }
 534
 535 # old code uses PVE::RPCEnvironment::is_worker();
 536 # new code should use PVE::RPCEnvironment->is_worker();
 537 sub is_worker {
 538     return PVE::RESTEnvironment->is_worker();
 539 }
 540
 541 1;