X-Git-Url: https://git.proxmox.com/?p=pve-docs.git;a=blobdiff_plain;f=pveum.adoc;h=db196b537389a2631113f11ac268987cf0e8ad2c;hp=f119f69b8716b3acce4111ce023fa8fff6c3a963;hb=054a7e7d52ceca8d428ae2a081dd820d0642cff6;hpb=80c0adcbc32f5e003ce754ac31201db16e522426 diff --git a/pveum.adoc b/pveum.adoc index f119f69..db196b5 100644 --- a/pveum.adoc +++ b/pveum.adoc @@ -2,7 +2,6 @@ ifdef::manvolnum[] pveum(1) ======== -include::attributes.txt[] :pve-toplevel: NAME @@ -23,11 +22,8 @@ endif::manvolnum[] ifndef::manvolnum[] User Management =============== -include::attributes.txt[] -endif::manvolnum[] -ifdef::wiki[] :pve-toplevel: -endif::wiki[] +endif::manvolnum[] // Copied from pve wiki: Revision as of 16:10, 27 October 2015 @@ -297,7 +293,7 @@ We use file system like paths to address these objects. These paths form a natural tree, and permissions of higher levels (shorter path) can optionally be propagated down within this hierarchy. -[[templated-paths]] +[[pveum_templated_paths]] Paths can be templated. When an API call requires permissions on a templated path, the path may contain references to parameters of the API call. These references are specified in curly braces. Some parameters are @@ -312,7 +308,7 @@ Some examples are: * `/vms`: Covers all VMs * `/vms/{vmid}`: Access to specific VMs * `/storage/{storeid}`: Access to a storages -* `/pool/{poolname}`: Access to VMs part of a < +* `/pool/{poolname}`: Access to VMs part of a <> * `/access/groups`: Group administration * `/access/realms/{realmid}`: Administrative access to realms @@ -352,8 +348,9 @@ tree of logic and access-check functions: Each(`and`) or any(`or`) further element in the current list has to be true. `["perm", , [ ... ], ...]`:: -The `path` is a templated parameter (see <>). All (or , if the `any` option is used, any) of the listed +The `path` is a templated parameter (see +<>). All (or , if the `any` +option is used, any) of the listed privileges must be allowed on the specified path. If a `require-param` option is specified, then its specified parameter is required even if the API call's schema otherwise lists it as being optional. @@ -384,8 +381,9 @@ associated with a realm, since user IDs are passed in the form of `@`. `["perm-modify", ]`:: -The `path` is a templated parameter (see <>). The user needs either the `Permissions.Modify` privilege, or, +The `path` is a templated parameter (see +<>). The user needs either the +`Permissions.Modify` privilege, or, depending on the path, the following privileges as a possible substitute: + * `/storage/...`: additionally requires 'Datastore.Allocate`