X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=blobdiff_plain;f=PVE%2FRPCEnvironment.pm;h=3ec2c912d220498ca50303e23db5a25e0b67b0c1;hp=31692ce2a027f37f9f7233f6568c1dc8f1d56b71;hb=b10d0e266bbbd8fad9a9c561beb21dd810dfa755;hpb=82b63965ebbeb41d16a76051018992144eda0a6a diff --git a/PVE/RPCEnvironment.pm b/PVE/RPCEnvironment.pm index 31692ce..3ec2c91 100644 --- a/PVE/RPCEnvironment.pm +++ b/PVE/RPCEnvironment.pm @@ -14,7 +14,6 @@ use PVE::INotify; use PVE::Cluster; use PVE::ProcFSTools; use PVE::AccessControl; -use CGI; # we use this singleton class to pass RPC related environment values @@ -29,6 +28,7 @@ my $pve_env; # that (also see perlipc) my $WORKER_PIDS; +my $WORKER_FLAG = 0; my $log_task_result = sub { my ($upid, $user, $status) = @_; @@ -236,6 +236,15 @@ sub check_any { raise_perm_exc("$path, " . join("|", @$privs)); }; +sub check_full { + my ($self, $username, $path, $privs, $any, $noerr) = @_; + if ($any) { + return $self->check_any($username, $path, $privs, $noerr); + } else { + return $self->check($username, $path, $privs, $noerr); + } +} + sub check_user_enabled { my ($self, $user, $noerr) = @_; @@ -250,6 +259,56 @@ sub check_user_exist { return PVE::AccessControl::check_user_exist($cfg, $user, $noerr); } +sub check_pool_exist { + my ($self, $pool, $noerr) = @_; + + my $cfg = $self->{user_cfg}; + + return 1 if $cfg->{pools}->{$pool}; + + return undef if $noerr; + + raise_perm_exc("pool '$pool' does not exist"); +} + +sub check_vm_perm { + my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_; + + my $cfg = $self->{user_cfg}; + + if ($pool) { + return if $self->check_full($user, "/pool/$pool", $privs, $any, 1); + } + return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr); +}; + +sub check_volume_access { + my ($self, $user, $storecfg, $vmid, $volid) = @_; + + # test if we have read access to volid + + my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1); + if ($sid) { + my ($vtype, undef, $ownervm) = PVE::Storage::parse_volname($storecfg, $volid); + if ($vtype eq 'iso' || $vtype eq 'vztmpl') { + # we simply allow access + } elsif (defined($ownervm) && defined($vmid) && ($ownervm == $vmid)) { + # we are owner - allow access + } elsif ($vtype eq 'backup' && $ownervm) { + $self->check($user, "/storage/$sid", ['Datastore.AllocateSpace']); + $self->check($user, "/vms/$ownervm", ['VM.Backup']); + } else { + # allow if we are Datastore administrator + $self->check($user, "/storage/$sid", ['Datastore.Allocate']); + } + } else { + die "Only root can pass arbitrary filesystem paths." + if $user ne 'root@pam'; + } + + return undef; +} + sub is_group_member { my ($self, $group, $user) = @_; @@ -268,14 +327,8 @@ sub filter_groups { my $groups = {}; foreach my $group (keys %{$cfg->{groups}}) { my $path = "/access/groups/$group"; - if ($any) { - if ($self->check_any($user, $path, $privs, 1)) { - $groups->{$group} = $cfg->{groups}->{$group}; - } - } else { - if ($self->check($user, $path, $privs, 1)) { - $groups->{$group} = $cfg->{groups}->{$group}; - } + if ($self->check_full($user, $path, $privs, $any, 1)) { + $groups->{$group} = $cfg->{groups}->{$group}; } } @@ -309,6 +362,8 @@ sub check_perm_modify { push @$testperms, 'Datastore.Allocate'; } elsif ($path =~ m|^/vms/.+$|) { push @$testperms, 'VM.Allocate'; + } elsif ($path =~ m|^/pool/.+$|) { + push @$testperms, 'Pool.Allocate'; } return $self->check_any($username, $path, $testperms, $noerr); @@ -338,13 +393,14 @@ sub exec_api2_perm_check { my ($t, $tmplpath, $privs, %options) = @$check; my $any = $options{any}; die "missing parameters" if !($tmplpath && $privs); + my $require_param = $options{require_param}; + if ($require_param && !defined($param->{$require_param})) { + return 0 if $noerr; + raise_perm_exc(); + } my $path = PVE::Tools::template_replace($tmplpath, $param); $path = PVE::AccessControl::normalize_path($path); - if ($any) { - return $self->check_any($username, $path, $privs, $noerr); - } else { - return $self->check($username, $path, $privs, $noerr); - } + return $self->check_full($username, $path, $privs, $any, $noerr); } elsif ($test eq 'userid-group') { my $userid = $param->{userid}; my ($t, $privs, %options) = @$check; @@ -368,19 +424,17 @@ sub exec_api2_perm_check { } return 1; } elsif ($test eq 'userid-param') { - my ($userid, undef, $realm) = verify_username($param->{userid}); - return if !$self->check_user_exist($userid, $noerr); + my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid}); my ($t, $subtest) = @$check; die "missing parameters" if !$subtest; if ($subtest eq 'self') { - return 1 if $username eq 'userid'; + return 0 if !$self->check_user_exist($userid, $noerr); + return 1 if $username eq $userid; return 0 if $noerr; raise_perm_exc(); } elsif ($subtest eq 'Realm.AllocateUser') { my $path = "/access/realm/$realm"; return $self->check($username, $path, ['Realm.AllocateUser'], $noerr); - return 0 if $noerr; - raise_perm_exc("$path, 'Realm.AllocateUser'"); } else { die "unknown userid-param test"; } @@ -467,51 +521,6 @@ sub get { return $pve_env; } -sub parse_params { - my ($self, $enable_upload) = @_; - - if ($self->{request_rec}) { - my $cgi; - if ($enable_upload) { - $cgi = CGI->new($self->{request_rec}); - } else { - # disable upload using empty upload_hook - $cgi = CGI->new($self->{request_rec}, sub {}, undef, 0); - } - $self->{cgi} = $cgi; - my $params = $cgi->Vars(); - return PVE::Tools::decode_utf8_parameters($params); - } elsif ($self->{params}) { - return $self->{params}; - } else { - die "no parameters registered"; - } -} - -sub get_upload_info { - my ($self, $param) = @_; - - my $cgi = $self->{cgi}; - die "CGI not initialized" if !$cgi; - - my $pd = $cgi->param($param); - die "unable to get cgi parameter info\n" if !$pd; - my $info = $cgi->uploadInfo($pd); - die "unable to get cgi upload info\n" if !$info; - - my $res = { %$info }; - - my $tmpfilename = $cgi->tmpFileName($pd); - die "unable to get cgi upload file name\n" if !$tmpfilename; - $res->{tmpfilename} = $tmpfilename; - - #my $hndl = $cgi->upload($param); - #die "unable to get cgi upload handle\n" if !$hndl; - #$res->{handle} = $hndl->handle; - - return $res; -} - # init_request - must be called before each RPC request sub init_request { my ($self, %params) = @_; @@ -524,11 +533,6 @@ sub init_request { foreach my $p (keys %params) { if ($p eq 'userconfig') { $userconfig = $params{$p}; - } elsif ($p eq 'request_rec') { - # pass Apache2::RequestRec - $self->{request_rec} = $params{$p}; - } elsif ($p eq 'params') { - $self->{params} = $params{$p}; } else { die "unknown parameter '$p'"; } @@ -611,6 +615,10 @@ sub get_user { return $self->{user}; } +sub is_worker { + return $WORKER_FLAG; +} + # read/update list of active workers # we move all finished tasks to the archive index, # but keep aktive and most recent task in the active file. @@ -673,7 +681,7 @@ sub active_workers { my @arlist = (); foreach my $task (@ta) { if (!$task->{saved}) { - $archive .= sprintf("$task->{upid} %08X $task->{status}\n", $task->{endtime}); + $archive .= sprintf("%s %08X %s\n", $task->{upid}, $task->{endtime}, $task->{status}); $save = 1; push @arlist, $task; $task->{saved} = 1; @@ -767,14 +775,14 @@ sub check_worker { # STDOUT,STDERR are redirected to the filename returned by upid_decode # NOTE: we simulate running in foreground if ($self->{type} eq 'cli') sub fork_worker { - my ($self, $dtype, $id, $user, $function) = @_; + my ($self, $dtype, $id, $user, $function, $background) = @_; $dtype = 'unknown' if !defined ($dtype); $id = '' if !defined ($id); $user = 'root@pve' if !defined ($user); - my $sync = $self->{type} eq 'cli' ? 1 : 0; + my $sync = ($self->{type} eq 'cli' && !$background) ? 1 : 0; local $SIG{INT} = local $SIG{QUIT} = @@ -805,6 +813,7 @@ sub fork_worker { if (!$cpid) { # child $0 = "task $upid"; + $WORKER_FLAG = 1; $SIG{INT} = $SIG{QUIT} = $SIG{TERM} = sub { die "received interrupt\n"; };