Am 16/11/2022 um 15:04 schrieb Fiona Ebner: > Currently, suffenciently privileged users may edit a backup job, but > cannot run the very same job manually (via the vzdump API call). The > first patch addresses this by removing the root-only restriction from > retention and performance settings. Retention will require > Datastore.Allocate on the target storage, because it's essentially > removal of certain backups, while performance settings will require > Sys.Modify on / which is the permission required to edit backup jobs. > > The next three patches are for deletion of parameters when updating a > backup job. Allowing to only delete a setting (previously, update > would fail if no parameter was set) and adding a check for the delete > options. > > Patch 5/6 restricts backup editing by requiring that the user has > appropriate permissions on the job's storage (and eventual newly set > storage) as well as on the default 'local' storage when removing the > storage. Jobs with a dumpdir can only be edited by root. This is a > breaking API change, but requiring permission on the storage should > be sensible and allows for more flexible permission configurations. > > The last patch introduces a helper to have the "what's the storage" > logic in one place. > > > Fiona Ebner (6): > api: vzdump: soften parameter permission checks > api: backup: update: turn delete into a hash > api: backup: update: allow only deleting > api: backup: update: check permissions of delete params too > api: backup: require Datastore.Allocate on storage > api: backup/vzdump: add get_storage_param helper > > PVE/API2/Backup.pm | 62 ++++++++++++++++++++++++++++++++++++++-------- > PVE/API2/VZDump.pm | 32 ++++++++++++++++-------- > PVE/VZDump.pm | 11 ++++++-- > 3 files changed, 82 insertions(+), 23 deletions(-) >
applied remaining series, thanks! fwiw, I did some small follow-up for "api: backup: update: check permissions of delete params too", just to get the order of checking those params before the pool as before and as the create endpoint has, I don't think it has a practical effect, but it just felt slightly odd.. _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
