X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=blobdiff_plain;f=PVE%2FAPI2%2FAccessControl.pm;h=444fb690bd2e6b287a5c96fbecab1fe2c86a925a;hp=913bdd81a8fea82fd6ed71735ba696be80734b08;hb=a2c18811d33d7e09765a7b0f09bba47bc9523822;hpb=39c85db819dc564e89270f6f6d15dbce79d0540b diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm index 913bdd8..444fb69 100644 --- a/PVE/API2/AccessControl.pm +++ b/PVE/API2/AccessControl.pm @@ -15,7 +15,6 @@ use PVE::API2::User; use PVE::API2::Group; use PVE::API2::Role; use PVE::API2::ACL; -use PVE::API2::Pool; use base qw(PVE::RESTHandler); @@ -44,16 +43,14 @@ __PACKAGE__->register_method ({ path => 'domains', }); -__PACKAGE__->register_method ({ - subclass => "PVE::API2::Pool", - path => 'pools', -}); - __PACKAGE__->register_method ({ name => 'index', path => '', method => 'GET', description => "Directory index.", + permissions => { + user => 'all', + }, parameters => { additionalProperties => 0, properties => {}, @@ -91,7 +88,7 @@ __PACKAGE__->register_method ({ my $verify_auth = sub { - my ($rpcenv, $username, $pw_or_ticket, $path, $privs) = @_; + my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs) = @_; my $normpath = PVE::AccessControl::normalize_path($path); @@ -102,7 +99,7 @@ my $verify_auth = sub { } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) { # valid vnc ticket } else { - $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket); + $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); } my $privlist = [ PVE::Tools::split_list($privs) ]; @@ -114,14 +111,14 @@ my $verify_auth = sub { }; my $create_ticket = sub { - my ($rpcenv, $username, $pw_or_ticket) = @_; + my ($rpcenv, $username, $pw_or_ticket, $otp) = @_; my $ticketuser; if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) && ($ticketuser eq 'root@pam' || $ticketuser eq $username)) { # valid ticket. Note: root@pam can create tickets for other users } else { - $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket); + $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); } my $ticket = PVE::AccessControl::assemble_ticket($username); @@ -134,6 +131,66 @@ my $create_ticket = sub { }; }; +my $compute_api_permission = sub { + my ($rpcenv, $authuser) = @_; + + my $usercfg = $rpcenv->{user_cfg}; + + my $res = {}; + my $priv_re_map = { + vms => qr/VM\.|Permissions\.Modify/, + access => qr/(User|Group)\.|Permissions\.Modify/, + storage => qr/Datastore\./, + nodes => qr/Sys\.|Permissions\.Modify/, + dc => qr/Sys\.Audit/, + }; + map { $res->{$_} = {} } keys %$priv_re_map; + + my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage']; + + my $checked_paths = {}; + foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) { + next if $checked_paths->{$path}; + $checked_paths->{$path} = 1; + + my $path_perm = $rpcenv->permissions($authuser, $path); + + my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc'; + if ($toplevel eq 'pool') { + foreach my $priv (keys %$path_perm) { + if ($priv =~ m/^VM\./) { + $res->{vms}->{$priv} = 1; + } elsif ($priv =~ m/^Datastore\./) { + $res->{storage}->{$priv} = 1; + } elsif ($priv eq 'Permissions.Modify') { + $res->{storage}->{$priv} = 1; + $res->{vms}->{$priv} = 1; + } + } + } else { + my $priv_regex = $priv_re_map->{$toplevel} // next; + foreach my $priv (keys %$path_perm) { + next if $priv !~ m/^($priv_regex)/; + $res->{$toplevel}->{$priv} = 1; + } + } + } + + return $res; +}; + +__PACKAGE__->register_method ({ + name => 'get_ticket', + path => 'ticket', + method => 'GET', + permissions => { user => 'world' }, + description => "Dummy. Useful for formaters which want to priovde a login page.", + parameters => { + additionalProperties => 0, + }, + returns => { type => "null" }, + code => sub { return undef; }}); + __PACKAGE__->register_method ({ name => 'create_ticket', path => 'ticket', @@ -151,14 +208,22 @@ __PACKAGE__->register_method ({ description => "User name", type => 'string', maxLength => 64, + completion => \&PVE::AccessControl::complete_username, }, realm => get_standard_option('realm', { description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username \@.", - optional => 1}), + optional => 1, + completion => \&PVE::AccessControl::complete_realm, + }), password => { description => "The secret password. This can also be a valid ticket.", type => 'string', }, + otp => { + description => "One-time password for Two-factor authentication.", + type => 'string', + optional => 1, + }, path => { description => "Verify ticket, and check if user have access 'privs' on 'path'", type => 'string', @@ -192,24 +257,26 @@ __PACKAGE__->register_method ({ my $rpcenv = PVE::RPCEnvironment::get(); my $res; - eval { # test if user exists and is enabled $rpcenv->check_user_enabled($username); if ($param->{path} && $param->{privs}) { - $res = &$verify_auth($rpcenv, $username, $param->{password}, + $res = &$verify_auth($rpcenv, $username, $param->{password}, $param->{otp}, $param->{path}, $param->{privs}); } else { - $res = &$create_ticket($rpcenv, $username, $param->{password}); + $res = &$create_ticket($rpcenv, $username, $param->{password}, $param->{otp}); } }; if (my $err = $@) { my $clientip = $rpcenv->get_client_ip() || ''; syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err"); - die $err; + # do not return any info to prevent user enumeration attacks + die PVE::Exception->new("authentication failure\n", code => 401); } + $res->{cap} = &$compute_api_permission($rpcenv, $username); + PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'"); return $res; @@ -220,10 +287,13 @@ __PACKAGE__->register_method ({ path => 'password', method => 'PUT', permissions => { - description => "Each user is allowed to change his own password. A user can change the password of another user if he has modify permission on /access/groups/ on a group where user is member of.", + description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user ) and 'User.Modify' permission on /access/groups/ on a group where user is member of.", check => [ 'or', ['userid-param', 'self'], - ['userid-group', ['User.Modify']], + [ 'and', + [ 'userid-param', 'Realm.AllocateUser'], + [ 'userid-group', ['User.Modify']] + ] ], }, protected => 1, # else we can't access shadow files @@ -231,7 +301,9 @@ __PACKAGE__->register_method ({ parameters => { additionalProperties => 0, properties => { - userid => get_standard_option('userid'), + userid => get_standard_option('userid', { + completion => \&PVE::AccessControl::complete_username, + }), password => { description => "The new password.", type => 'string', @@ -260,6 +332,8 @@ __PACKAGE__->register_method ({ } else { # only root may change root password raise_perm_exc() if $userid eq 'root@pam'; + # do not allow to change system user passwords + raise_perm_exc() if $realm eq 'pam'; } }