src/test/perm-test6.pl

   1 #!/usr/bin/perl -w
   2
   3 use strict;
   4 use warnings;
   5
   6 use Getopt::Long;
   7
   8 use PVE::Tools;
   9
  10 use PVE::AccessControl;
  11 use PVE::RPCEnvironment;
  12
  13 my $rpcenv = PVE::RPCEnvironment->init('cli');
  14
  15 my $cfgfn = "test6.cfg";
  16 $rpcenv->init_request(userconfig => $cfgfn);
  17
  18 sub check_roles {
  19     my ($user, $path, $expected_result) = @_;
  20
  21     my $roles = PVE::AccessControl::roles($rpcenv->{user_cfg}, $user, $path);
  22     my $res = join(',', sort keys %$roles);
  23
  24     die "unexpected result\nneed '${expected_result}'\ngot '$res'\n"
  25         if $res ne $expected_result;
  26
  27     print "ROLES:$path:$user:$res\n";
  28 }
  29
  30 sub check_permissions {
  31     my ($user, $path, $expected_result) = @_;
  32
  33     my $perm = $rpcenv->permissions($user, $path);
  34     my $res = join(',', sort keys %$perm);
  35
  36     die "unexpected result\nneed '${expected_result}'\ngot '$res'\n"
  37         if $res ne $expected_result;
  38
  39     $perm = $rpcenv->permissions($user, $path);
  40     $res = join(',', sort keys %$perm);
  41     die "unexpected result (compiled)\nneed '${expected_result}'\ngot '$res'\n"
  42         if $res ne $expected_result;
  43
  44     print "PERM:$path:$user:$res\n";
  45 }
  46
  47 check_roles('User1@pve', '', '');
  48 check_roles('User2@pve', '', '');
  49 check_roles('User3@pve', '', '');
  50 check_roles('User4@pve', '', '');
  51
  52 check_roles('User1@pve', '/vms', 'RoleTEST1');
  53 check_roles('User2@pve', '/vms', 'RoleTEST1');
  54 check_roles('User3@pve', '/vms', 'NoAccess');
  55 check_roles('User4@pve', '/vms', '');
  56
  57 check_roles('User1@pve', '/vms/100', 'RoleTEST1');
  58 check_roles('User2@pve', '/vms/100', 'RoleTEST1');
  59 check_roles('User3@pve', '/vms/100', 'NoAccess');
  60 check_roles('User4@pve', '/vms/100', '');
  61
  62 check_roles('User1@pve', '/vms/300', 'RoleTEST1');
  63 check_roles('User2@pve', '/vms/300', 'RoleTEST1');
  64 check_roles('User3@pve', '/vms/300', 'NoAccess');
  65 check_roles('User4@pve', '/vms/300', 'RoleTEST1');
  66
  67 check_permissions('User1@pve', '/vms/500', 'VM.Console,VM.PowerMgmt');
  68 check_permissions('User2@pve', '/vms/500', 'VM.Console,VM.PowerMgmt');
  69 # without pool
  70 check_roles('User3@pve', '/vms/500', 'NoAccess');
  71 # with pool
  72 check_permissions('User3@pve', '/vms/500', '');
  73 # without pool
  74 check_roles('User4@pve', '/vms/500', '');
  75 # with pool
  76 check_permissions('User4@pve', '/vms/500', '');
  77
  78 # without pool, checking no access on parent pool
  79 check_roles('intern@pve', '/vms/600', '');
  80 # once more, with VM in nested pool
  81 check_roles('intern@pve', '/vms/700', '');
  82 # with propagated ACL
  83 check_roles('User4@pve', '/vms/700', '');
  84 # with pool, checking no access on parent pool
  85 check_permissions('intern@pve', '/vms/600', '');
  86 # once more, with VM in nested pool
  87 check_permissions('intern@pve', '/vms/700', 'VM.Audit');
  88 # with propagated ACL
  89 check_permissions('User4@pve', '/vms/700', 'VM.Console');
  90
  91 # check nested pool permissions
  92 check_roles('intern@pve', '/pool/marketing/interns', 'RoleINTERN');
  93 check_roles('User4@pve', '/pool/marketing/interns', 'RoleMARKETING');
  94
  95 check_permissions('User1@pve', '/vms/600', 'VM.Console');
  96 check_permissions('User2@pve', '/vms/600', 'VM.Console');
  97 check_permissions('User3@pve', '/vms/600', '');
  98 check_permissions('User4@pve', '/vms/600', 'VM.Console');
  99
 100 check_permissions('User1@pve', '/storage/store1', 'VM.Console,VM.PowerMgmt');
 101 check_permissions('User2@pve', '/storage/store1', 'VM.PowerMgmt');
 102 check_permissions('User3@pve', '/storage/store1', 'VM.PowerMgmt');
 103 check_permissions('User4@pve', '/storage/store1', 'VM.Console');
 104
 105 check_permissions('User1@pve', '/storage/store2', 'VM.PowerMgmt');
 106 check_permissions('User2@pve', '/storage/store2', 'VM.PowerMgmt');
 107 check_permissions('User3@pve', '/storage/store2', 'VM.PowerMgmt');
 108 check_permissions('User4@pve', '/storage/store2', '');
 109
 110 print "all tests passed\n";
 111
 112 exit (0);