[pve-devel] [PATCH qemu-server v6 2/3] Permission check for virtiofs directory access

[Markus Frank]

Signed-off-by: Markus Frank <m.fr...@proxmox.com>
---
 PVE/API2/Qemu.pm | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index d0c199b..2048e4a 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -585,6 +585,19 @@ my $check_vm_create_serial_perm = sub {
     return 1;
 };
 
+my sub check_vm_dir_perm {
+    my ($rpcenv, $authuser, $param) = @_;
+
+    return 1 if $authuser eq 'root@pam';
+
+    foreach my $opt (keys %{$param}) {
+       next if $opt !~ m/^virtiofs\d+$/;
+       my $virtiofs = 
PVE::JSONSchema::parse_property_string('pve-qm-virtiofs', $param->{$opt});
+       $rpcenv->check_full($authuser, "/mapping/dir/$virtiofs->{dirid}", 
['Mapping.Use']);
+    }
+    return 1;
+};
+
 my sub check_usb_perm {
     my ($rpcenv, $authuser, $vmid, $pool, $opt, $value) = @_;
 
@@ -686,6 +699,8 @@ my $check_vm_modify_config_perm = sub {
            # the user needs Disk and PowerMgmt privileges to change the vmstate
            # also needs privileges on the storage, that will be checked later
            $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk', 
'VM.PowerMgmt' ]);
+       } elsif ($opt =~ m/^virtiofs\d$/) {
+           $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
        } else {
            # catches args, lock, etc.
            # new options will be checked here
@@ -924,6 +939,7 @@ __PACKAGE__->register_method({
 
            &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ 
keys %$param]);
 
+           check_vm_dir_perm($rpcenv, $authuser, $param);
            &$check_vm_create_serial_perm($rpcenv, $authuser, $vmid, $pool, 
$param);
            check_vm_create_usb_perm($rpcenv, $authuser, $vmid, $pool, $param);
            check_vm_create_hostpci_perm($rpcenv, $authuser, $vmid, $pool, 
$param);
@@ -1646,6 +1662,8 @@ my $update_vm_api  = sub {
 
     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys 
%$param]);
 
+    check_vm_dir_perm($rpcenv, $authuser, $param);
+
     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 
     PVE::QemuServer::check_bridge_access($rpcenv, $authuser, $param);
-- 
2.39.2



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel