fix access control

diff --git a/PVE/API2/ACL.pm b/PVE/API2/ACL.pm
index f122542defb292fc71d7d344f72217146ab761de..66f4129280fe937e537e887b54b0e4e8043f8b58 100644 (file)
--- a/PVE/API2/ACL.pm
+++ b/PVE/API2/ACL.pm
@@ -20,6 +20,9 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "Get Access Control List (ACLs).",
     path => '', 
     method => 'GET',
     description => "Get Access Control List (ACLs).",

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Audit', 'Permissions.Modify'], any => 1],
+    },

     parameters => {
        additionalProperties => 0,
        properties => {},
     parameters => {
        additionalProperties => 0,
        properties => {},


@@ -77,6 +80,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'PUT',
     protected => 1,
     path => '', 
     method => 'PUT',

+    permissions => { 
+       check => ['perm', '/access', ['Permissions.Modify']],
+    },

     description => "Update Access Control List (add or remove permissions).",
     parameters => {
        additionalProperties => 0,
     description => "Update Access Control List (add or remove permissions).",
     parameters => {
        additionalProperties => 0,

diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm
index 46b55104238da897f3d2e8c809bcd97fb1ad8efc..a4076481e6364999276b3b5ede4645334190a190 100644 (file)
--- a/PVE/API2/AccessControl.pm
+++ b/PVE/API2/AccessControl.pm
@@ -132,7 +132,10 @@ __PACKAGE__->register_method ({
     name => 'create_ticket', 
     path => 'ticket', 
     method => 'POST',
     name => 'create_ticket', 
     path => 'ticket', 
     method => 'POST',

-    permissions => { user => 'world' },
+    permissions => { 
+       description => "You need to pass valid credientials.",
+       user => 'world' 
+    },

     protected => 1, # else we can't access shadow files
     description => "Create or verify authentication ticket.",
     parameters => {
     protected => 1, # else we can't access shadow files
     description => "Create or verify authentication ticket.",
     parameters => {

diff --git a/PVE/API2/Domains.pm b/PVE/API2/Domains.pm
index c79e44e0f033a1cbc08a645efabe029677ef9812..8ffd21765eb7eb1bcb1dbf114f61acd99e2187dc 100644 (file)
--- a/PVE/API2/Domains.pm
+++ b/PVE/API2/Domains.pm
@@ -7,9 +7,6 @@ use PVE::AccessControl;
 use PVE::JSONSchema qw(get_standard_option);
 
 use PVE::SafeSyslog;
 use PVE::JSONSchema qw(get_standard_option);
 
 use PVE::SafeSyslog;

-
-use Data::Dumper; # fixme: remove
-

 use PVE::RESTHandler;
 
 my $domainconfigfile = "domains.cfg";
 use PVE::RESTHandler;
 
 my $domainconfigfile = "domains.cfg";


@@ -60,6 +57,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'POST',
     protected => 1,
     path => '', 
     method => 'POST',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Add an authentication server.",
     parameters => {
        additionalProperties => 0,
     description => "Add an authentication server.",
     parameters => {
        additionalProperties => 0,


@@ -167,6 +167,9 @@ __PACKAGE__->register_method ({
     name => 'update', 
     path => '{realm}', 
     method => 'PUT',
     name => 'update', 
     path => '{realm}', 
     method => 'PUT',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Update authentication server settings.",
     protected => 1,
     parameters => {
     description => "Update authentication server settings.",
     protected => 1,
     parameters => {


@@ -269,6 +272,9 @@ __PACKAGE__->register_method ({
     path => '{realm}', 
     method => 'GET',
     description => "Get auth server configuration.",
     path => '{realm}', 
     method => 'GET',
     description => "Get auth server configuration.",

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Audit']],
+    },

     parameters => {
        additionalProperties => 0,
        properties => {
     parameters => {
        additionalProperties => 0,
        properties => {


@@ -294,6 +300,9 @@ __PACKAGE__->register_method ({
     name => 'delete', 
     path => '{realm}', 
     method => 'DELETE',
     name => 'delete', 
     path => '{realm}', 
     method => 'DELETE',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Delete an authentication server.",
     protected => 1,
     parameters => {
     description => "Delete an authentication server.",
     protected => 1,
     parameters => {

diff --git a/PVE/API2/Group.pm b/PVE/API2/Group.pm
index 3a8022568c9bef1626756efeb5b16f96d81a8f9b..435e0190890ec4a698b253f26a539631b60037fa 100644 (file)
--- a/PVE/API2/Group.pm
+++ b/PVE/API2/Group.pm
@@ -33,6 +33,10 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "Group index.",
     path => '', 
     method => 'GET',
     description => "Group index.",

+    permissions => { 
+       description => "The returned list is restricted to groups where you have 'User.Add' or 'Sys.Audit' permissions on '/access', or 'User.Add' on /access/groups/<group>.",
+       user => 'all',
+    },

     parameters => {
        additionalProperties => 0,
        properties => {},
     parameters => {
        additionalProperties => 0,
        properties => {},


@@ -52,9 +56,16 @@ __PACKAGE__->register_method ({
     
        my $res = [];
 
     
        my $res = [];
 

+       my $rpcenv = PVE::RPCEnvironment::get();

        my $usercfg = cfs_read_file("user.cfg");
        my $usercfg = cfs_read_file("user.cfg");

+       my $authuser = $rpcenv->get_user();
+
+       my $privs = [ 'User.Add', 'Sys.Audit' ];
+       my $allow = $rpcenv->check_any($authuser, "/access", $privs, 1);
+       my $allowed_groups = $rpcenv->filter_groups($authuser, $privs, 1);

  
        foreach my $group (keys %{$usercfg->{groups}}) {
  
        foreach my $group (keys %{$usercfg->{groups}}) {

+           next if !($allow || $allowed_groups->{$group});

            my $entry = &$extract_group_data($usercfg->{groups}->{$group});
            $entry->{groupid} = $group;
            push @$res, $entry;
            my $entry = &$extract_group_data($usercfg->{groups}->{$group});
            $entry->{groupid} = $group;
            push @$res, $entry;


@@ -68,6 +79,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'POST',
     protected => 1,
     path => '', 
     method => 'POST',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Create new group.",
     parameters => {
        additionalProperties => 0,
     description => "Create new group.",
     parameters => {
        additionalProperties => 0,


@@ -106,6 +120,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '{groupid}', 
     method => 'PUT',
     protected => 1,
     path => '{groupid}', 
     method => 'PUT',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Update group data.",
     parameters => {
        additionalProperties => 0,
     description => "Update group data.",
     parameters => {
        additionalProperties => 0,


@@ -144,6 +161,9 @@ __PACKAGE__->register_method ({
     name => 'read_group', 
     path => '{groupid}', 
     method => 'GET',
     name => 'read_group', 
     path => '{groupid}', 
     method => 'GET',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Audit']],
+    },

     description => "Get group configuration.",
     parameters => {
        additionalProperties => 0,
     description => "Get group configuration.",
     parameters => {
        additionalProperties => 0,


@@ -172,6 +192,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '{groupid}', 
     method => 'DELETE',
     protected => 1,
     path => '{groupid}', 
     method => 'DELETE',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Delete group.",
     parameters => {
        additionalProperties => 0,
     description => "Delete group.",
     parameters => {
        additionalProperties => 0,

diff --git a/PVE/API2/Role.pm b/PVE/API2/Role.pm
index 396ba488f8684994272dd63031ff52249eb13262..509938c00fc4e6cc9bcee4e31f12ba44ace741ea 100644 (file)
--- a/PVE/API2/Role.pm
+++ b/PVE/API2/Role.pm
@@ -18,6 +18,9 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "Role index.",
     path => '', 
     method => 'GET',
     description => "Role index.",

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Audit']],
+    },

     parameters => {
        additionalProperties => 0,
        properties => {},
     parameters => {
        additionalProperties => 0,
        properties => {},


@@ -52,6 +55,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'POST',
     protected => 1,
     path => '', 
     method => 'POST',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Create new role.",
     parameters => {
        additionalProperties => 0,
     description => "Create new role.",
     parameters => {
        additionalProperties => 0,


@@ -89,6 +95,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '{roleid}', 
     method => 'PUT',
     protected => 1,
     path => '{roleid}', 
     method => 'PUT',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Create new role.",
     parameters => {
        additionalProperties => 0,
     description => "Create new role.",
     parameters => {
        additionalProperties => 0,


@@ -131,6 +140,9 @@ __PACKAGE__->register_method ({
     name => 'read_role', 
     path => '{roleid}', 
     method => 'GET',
     name => 'read_role', 
     path => '{roleid}', 
     method => 'GET',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Audit']],
+    },

     description => "Get role configuration.",
     parameters => {
        additionalProperties => 0,
     description => "Get role configuration.",
     parameters => {
        additionalProperties => 0,


@@ -159,6 +171,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '{roleid}', 
     method => 'DELETE',
     protected => 1,
     path => '{roleid}', 
     method => 'DELETE',

+    permissions => { 
+       check => ['perm', '/access', ['Sys.Modify']],
+    },

     description => "Delete role.",
     parameters => {
        additionalProperties => 0,
     description => "Delete role.",
     parameters => {
        additionalProperties => 0,

diff --git a/PVE/API2/User.pm b/PVE/API2/User.pm
index 6504ab9f29bbdf0bbe4f4165be94cf6aa920418d..aa88dfd72f4898524e8e407aada6230ccd61311f 100644 (file)
--- a/PVE/API2/User.pm
+++ b/PVE/API2/User.pm
@@ -37,7 +37,10 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "User index.",
     path => '', 
     method => 'GET',
     description => "User index.",

-    permissions => { user => 'all' },
+    permissions => { 
+       description => "The returned list is restricted to users where you have 'User.Modify' or 'User.Delete' permissions on '/access' or on a group the user belongs too. But it always includes the current (authenticated) user.",
+       user => 'all',
+    },

     parameters => {
        additionalProperties => 0,
        properties => {
     parameters => {
        additionalProperties => 0,
        properties => {


@@ -98,6 +101,10 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'POST',
     protected => 1,
     path => '', 
     method => 'POST',

+    permissions => { 
+       description => "You need 'User.Add' permissions to '/access/groups/<group>' for any group specified, or 'User.Add' on '/access' if you pass no groups.",
+       check => ['userid-group', ['User.Add'], groups_param => 1],
+    },

     description => "Create new user.",
     parameters => {
        additionalProperties => 0,
     description => "Create new user.",
     parameters => {
        additionalProperties => 0,


@@ -176,6 +183,9 @@ __PACKAGE__->register_method ({
     path => '{userid}', 
     method => 'GET',
     description => "Get user configuration.",
     path => '{userid}', 
     method => 'GET',
     description => "Get user configuration.",

+    permissions => { 
+       check => ['userid-group', ['User.Modify']],
+    },

     parameters => {
        additionalProperties => 0,
        properties => {
     parameters => {
        additionalProperties => 0,
        properties => {


@@ -212,6 +222,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '{userid}', 
     method => 'PUT',
     protected => 1,
     path => '{userid}', 
     method => 'PUT',

+    permissions => { 
+       check => ['userid-group', ['User.Modify'], groups_param => 1 ],
+    },

     description => "Update user configuration.",
     parameters => {
        additionalProperties => 0,
     description => "Update user configuration.",
     parameters => {
        additionalProperties => 0,