[pve-devel] [PATCH v4 access-control 04/18] api: roles: only allow modifying roles to add/remove SU if user has SU themselves

[Oguz Bektas]

Suggested-by: Fabian Grünbichler <f.gruenbich...@proxmox.com>
Signed-off-by: Oguz Bektas <o.bek...@proxmox.com>
---
 src/PVE/API2/Role.pm | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/PVE/API2/Role.pm b/src/PVE/API2/Role.pm
index 70a92b6..4a09ad6 100644
--- a/src/PVE/API2/Role.pm
+++ b/src/PVE/API2/Role.pm
@@ -4,6 +4,7 @@ use strict;
 use warnings;
 use PVE::Cluster qw (cfs_read_file cfs_write_file);
 use PVE::AccessControl;
+use PVE::Tools qw (split_list);
 use PVE::JSONSchema qw(get_standard_option register_standard_option);
 
 use PVE::SafeSyslog;
@@ -90,11 +91,19 @@ __PACKAGE__->register_method ({
 
                my $usercfg = cfs_read_file("user.cfg");
 
+               my $rpcenv = PVE::RPCEnvironment::get();
+               my $authuser = $rpcenv->get_user();
+               my $is_superuser = $rpcenv->check($authuser, "/", 
['SuperUser'], 1);
+
                my $role = $param->{roleid};
 
                die "role '$role' already exists\n"
                    if $usercfg->{roles}->{$role};
 
+               my $contains_superuser = grep { $_ eq 'SuperUser' } 
split_list($param->{privs});
+               die "only superusers can add this privilege!\n"
+                   if $contains_superuser && !$is_superuser;
+
                $usercfg->{roles}->{$role} = {};
 
                PVE::AccessControl::add_role_privs($role, $usercfg, 
$param->{privs});
@@ -136,9 +145,21 @@ __PACKAGE__->register_method ({
 
                my $usercfg = cfs_read_file("user.cfg");
 
+               my $rpcenv = PVE::RPCEnvironment::get();
+               my $authuser = $rpcenv->get_user();
+               my $is_superuser = $rpcenv->check($authuser, "/", 
['SuperUser'], 1);
+
                die "role '$role' does not exist\n"
                    if !$usercfg->{roles}->{$role};
 
+               my @old_role_privs = keys(%{$usercfg->{roles}->{$role}});
+
+               my $contained_superuser = grep { $_ eq 'SuperUser' } 
@old_role_privs;
+               my $contains_superuser = grep { $_ eq 'SuperUser' } 
split_list($param->{privs});
+
+               die "only superusers can add/remove this privilege!\n"
+                   if ($contains_superuser || $contained_superuser) && 
!$is_superuser;
+
                $usercfg->{roles}->{$role} = {} if !$param->{append};
 
                PVE::AccessControl::add_role_privs($role, $usercfg, 
$param->{privs});
-- 
2.30.2



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel