allow admins to delete security groups

[pve-firewall.git] / src / PVE / API2 / Firewall / Rules.pm

diff --git a/src/PVE/API2/Firewall/Rules.pm b/src/PVE/API2/Firewall/Rules.pm
index 83190b4f3886e59d2564b4d65f2dfca275a98ae4..1aa6d2747424e6905caccd42734eaf4734ec5798 100644 (file)
--- a/src/PVE/API2/Firewall/Rules.pm
+++ b/src/PVE/API2/Firewall/Rules.pm
@@ -58,16 +58,19 @@ sub register_get_rules {
 
     my $properties = $class->additional_parameters();
 
+    my $rule_env = $class->rule_env();
+
     $class->register_method({
        name => 'get_rules',
        path => '',
        method => 'GET',
        description => "List rules.",
+       permissions => PVE::Firewall::rules_audit_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $properties,
        },
-       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
+       proxyto => $rule_env eq 'host' ? 'node' : undef,
        returns => {
            type => 'array',
            items => {
@@ -103,16 +106,19 @@ sub register_get_rule {
 
     $properties->{pos} = $api_properties->{pos};
     
+    my $rule_env = $class->rule_env();
+
     $class->register_method({
        name => 'get_rule',
        path => '{pos}',
        method => 'GET',
        description => "Get single rule data.",
+       permissions => PVE::Firewall::rules_audit_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $properties,
        },
-       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
+       proxyto => $rule_env eq 'host' ? 'node' : undef,
        returns => {
            type => "object",
            properties => {
@@ -146,17 +152,20 @@ sub register_create_rule {
     $create_rule_properties->{action}->{optional} = 0;
     $create_rule_properties->{type}->{optional} = 0;
     
+    my $rule_env = $class->rule_env();
+
     $class->register_method({
        name => 'create_rule',
        path => '',
        method => 'POST',
        description => "Create new rule.",
        protected => 1,
+       permissions => PVE::Firewall::rules_modify_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $create_rule_properties,
        },
-       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
+       proxyto => $rule_env eq 'host' ? 'node' : undef,
        returns => { type => "null" },
        code => sub {
            my ($param) = @_;
@@ -185,6 +194,8 @@ sub register_update_rule {
 
     $properties->{pos} = $api_properties->{pos};
     
+    my $rule_env = $class->rule_env();
+
     $properties->{moveto} = {
        description => "Move rule to new position <moveto>. Other arguments are ignored.",
        type => 'integer',
@@ -206,11 +217,12 @@ sub register_update_rule {
        method => 'PUT',
        description => "Modify rule data.",
        protected => 1,
+       permissions => PVE::Firewall::rules_modify_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $update_rule_properties,
        },
-       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
+       proxyto => $rule_env eq 'host' ? 'node' : undef,
        returns => { type => "null" },
        code => sub {
            my ($param) = @_;
@@ -259,17 +271,20 @@ sub register_delete_rule {
 
     $properties->{digest} = get_standard_option('pve-config-digest');
     
+    my $rule_env = $class->rule_env();
+
     $class->register_method({
        name => 'delete_rule',
        path => '{pos}',
        method => 'DELETE',
        description => "Delete rule.",
        protected => 1,
+       permissions => PVE::Firewall::rules_modify_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $properties,
        },
-       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
+       proxyto => $rule_env eq 'host' ? 'node' : undef,
        returns => { type => "null" },
        code => sub {
            my ($param) = @_;
@@ -344,6 +359,9 @@ __PACKAGE__->register_method({
     method => 'DELETE',
     description => "Delete security group.",
     protected => 1,
+    permissions => {
+       check => ['perm', '/', [ 'Sys.Modify' ]],
+    },
     parameters => {
        additionalProperties => 0,
        properties => {