X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=blobdiff_plain;f=PVE%2FAPI2%2FAccessControl.pm;h=f01180d138863ee50c21c25bf5f32b9868efb00b;hp=6046a8aeb3bf984f763f8dc183e32a3f4019f08b;hb=6084476178d2db030378ef402b9ba5a70df52d1e;hpb=b9180ed235f8ae6d7517fb232a1ed1986082e88f diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm index 6046a8a..f01180d 100644 --- a/PVE/API2/AccessControl.pm +++ b/PVE/API2/AccessControl.pm @@ -48,6 +48,9 @@ __PACKAGE__->register_method ({ path => '', method => 'GET', description => "Directory index.", + permissions => { + user => 'all', + }, parameters => { additionalProperties => 0, properties => {}, @@ -85,7 +88,7 @@ __PACKAGE__->register_method ({ my $verify_auth = sub { - my ($rpcenv, $username, $pw_or_ticket, $path, $privs) = @_; + my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs) = @_; my $normpath = PVE::AccessControl::normalize_path($path); @@ -96,7 +99,7 @@ my $verify_auth = sub { } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) { # valid vnc ticket } else { - $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket); + $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); } my $privlist = [ PVE::Tools::split_list($privs) ]; @@ -108,14 +111,14 @@ my $verify_auth = sub { }; my $create_ticket = sub { - my ($rpcenv, $username, $pw_or_ticket) = @_; + my ($rpcenv, $username, $pw_or_ticket, $otp) = @_; my $ticketuser; if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) && ($ticketuser eq 'root@pam' || $ticketuser eq $username)) { # valid ticket. Note: root@pam can create tickets for other users } else { - $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket); + $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); } my $ticket = PVE::AccessControl::assemble_ticket($username); @@ -128,11 +131,101 @@ my $create_ticket = sub { }; }; +my $compute_api_permission = sub { + my ($rpcenv, $authuser) = @_; + + my $usercfg = $rpcenv->{user_cfg}; + + my $nodelist = PVE::Cluster::get_nodelist(); + my $vmlist = PVE::Cluster::get_vmlist() || {}; + my $idlist = $vmlist->{ids} || {}; + + my $cfg = PVE::Storage::config(); + my @sids = PVE::Storage::storage_ids ($cfg); + + my $res = { + vms => {}, + storage => {}, + access => {}, + nodes => {}, + dc => {}, + }; + + my $extract_vm_caps = sub { + my ($path) = @_; + + my $perm = $rpcenv->permissions($authuser, $path); + foreach my $priv (keys %$perm) { + next if !($priv eq 'Permissions.Modify' || $priv =~ m/^VM\./); + $res->{vms}->{$priv} = 1; + } + }; + + foreach my $pool (keys %{$usercfg->{pools}}) { + &$extract_vm_caps("/pool/$pool"); + } + + foreach my $vmid (keys %$idlist, '__phantom__') { + &$extract_vm_caps("/vms/$vmid"); + } + + foreach my $storeid (@sids, '__phantom__') { + my $perm = $rpcenv->permissions($authuser, "/storage/$storeid"); + foreach my $priv (keys %$perm) { + next if !($priv eq 'Permissions.Modify' || $priv =~ m/^Datastore\./); + $res->{storage}->{$priv} = 1; + } + } + + foreach my $path (('/access/groups')) { + my $perm = $rpcenv->permissions($authuser, $path); + foreach my $priv (keys %$perm) { + next if $priv !~ m/^(User|Group)\./; + $res->{access}->{$priv} = 1; + } + } + + foreach my $group (keys %{$usercfg->{users}->{$authuser}->{groups}}, '__phantom__') { + my $perm = $rpcenv->permissions($authuser, "/access/groups/$group"); + if ($perm->{'User.Modify'}) { + $res->{access}->{'User.Modify'} = 1; + } + } + + foreach my $node (@$nodelist) { + my $perm = $rpcenv->permissions($authuser, "/nodes/$node"); + foreach my $priv (keys %$perm) { + next if $priv !~ m/^Sys\./; + $res->{nodes}->{$priv} = 1; + } + } + + my $perm = $rpcenv->permissions($authuser, "/"); + $res->{dc}->{'Sys.Audit'} = 1 if $perm->{'Sys.Audit'}; + + return $res; +}; + +__PACKAGE__->register_method ({ + name => 'get_ticket', + path => 'ticket', + method => 'GET', + permissions => { user => 'world' }, + description => "Dummy. Useful for formaters which want to priovde a login page.", + parameters => { + additionalProperties => 0, + }, + returns => { type => "null" }, + code => sub { return undef; }}); + __PACKAGE__->register_method ({ name => 'create_ticket', path => 'ticket', method => 'POST', - permissions => { user => 'world' }, + permissions => { + description => "You need to pass valid credientials.", + user => 'world' + }, protected => 1, # else we can't access shadow files description => "Create or verify authentication ticket.", parameters => { @@ -150,6 +243,11 @@ __PACKAGE__->register_method ({ description => "The secret password. This can also be a valid ticket.", type => 'string', }, + otp => { + description => "One-time password for Two-factor authentication.", + type => 'string', + optional => 1, + }, path => { description => "Verify ticket, and check if user have access 'privs' on 'path'", type => 'string', @@ -183,24 +281,26 @@ __PACKAGE__->register_method ({ my $rpcenv = PVE::RPCEnvironment::get(); my $res; - eval { # test if user exists and is enabled $rpcenv->check_user_enabled($username); if ($param->{path} && $param->{privs}) { - $res = &$verify_auth($rpcenv, $username, $param->{password}, + $res = &$verify_auth($rpcenv, $username, $param->{password}, $param->{otp}, $param->{path}, $param->{privs}); } else { - $res = &$create_ticket($rpcenv, $username, $param->{password}); + $res = &$create_ticket($rpcenv, $username, $param->{password}, $param->{otp}); } }; if (my $err = $@) { my $clientip = $rpcenv->get_client_ip() || ''; syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err"); - die $err; + # do not return any info to prevent user enumeration attacks + die PVE::Exception->new("authentication failure\n", code => 401); } + $res->{cap} = &$compute_api_permission($rpcenv, $username); + PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'"); return $res; @@ -210,7 +310,16 @@ __PACKAGE__->register_method ({ name => 'change_passsword', path => 'password', method => 'PUT', - permissions => { user => 'all' }, + permissions => { + description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user ) and 'User.Modify' permission on /access/groups/ on a group where user is member of.", + check => [ 'or', + ['userid-param', 'self'], + [ 'and', + [ 'userid-param', 'Realm.AllocateUser'], + [ 'userid-group', ['User.Modify']] + ] + ], + }, protected => 1, # else we can't access shadow files description => "Change user password.", parameters => { @@ -234,8 +343,7 @@ __PACKAGE__->register_method ({ my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid}); - my $usercfg = $rpcenv->{user_cfg}; - PVE::AccessControl::check_user_exist($usercfg, $userid); + $rpcenv->check_user_exist($userid); if ($authuser eq 'root@pam') { # OK - root can change anything @@ -244,14 +352,10 @@ __PACKAGE__->register_method ({ $rpcenv->check_user_enabled($userid); # OK - each user can change its own password } else { + # only root may change root password raise_perm_exc() if $userid eq 'root@pam'; - - my $privs = [ 'Sys.UserMod', 'Sys.UserAdd' ]; - if (!$rpcenv->check_any($authuser, "/access", $privs, 1)) { - my $groups = $rpcenv->filter_groups($authuser, $privs, 1); - my $allowed_users = $rpcenv->group_member_join([keys %$groups]); - raise_perm_exc() if !$allowed_users->{$userid}; - } + # do not allow to change system user passwords + raise_perm_exc() if $realm eq 'pam'; } }