The privilege VM.Monitor has a very ambiguous name and is planned to
be dropped. Most of the API endpoints using it are for the QEMU guest
agent commands. Introduce dedicated, more fine-grained privileges for
those.
There is a basic VM.GuestAgent.Audit privilege for read-only,
informational commands.
There are dedicated privileges VM.GuestAgent.File{Read,Write} for
the file-{read,write} commands. There is a separate
VM.GuestAgent.FileSystemMgmt privilege for filesystem freeze, thaw
and trim.
The VM.GuestAgent.Unrestricted privilege is to allow all guest agent
operations, in particular also execution of arbitrary commands with
guest-exec.
Signed-off-by: Fiona Ebner <f.eb...@proxmox.com>
---
src/PVE/AccessControl.pm | 6 +++++-
src/test/perm-test1.pl | 8 ++++++--
2 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index cebb76f..3e12850 100644
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -1059,6 +1059,7 @@ my $privgroups = {
'VM.Config.Options', # covers all other things
'VM.Allocate',
'VM.Clone',
+ 'VM.GuestAgent.Unrestricted',
'VM.Migrate',
'VM.Monitor',
'VM.Snapshot',
@@ -1069,10 +1070,13 @@ my $privgroups = {
'VM.Config.Cloudinit',
'VM.Console',
'VM.Backup',
+ 'VM.GuestAgent.FileRead',
+ 'VM.GuestAgent.FileSystemMgmt',
+ 'VM.GuestAgent.FileWrite',
'VM.PowerMgmt',
],
audit => [
- 'VM.Audit',
+ 'VM.Audit', 'VM.GuestAgent.Audit',
],
},
Sys => {
diff --git a/src/test/perm-test1.pl b/src/test/perm-test1.pl
index 69b396e..bf01ac6 100755
--- a/src/test/perm-test1.pl
+++ b/src/test/perm-test1.pl
@@ -65,7 +65,9 @@ check_permission(
'' # sorted, comma-separated expected privilege string
.
'VM.Allocate,VM.Audit,VM.Backup,VM.Clone,VM.Config.CDROM,VM.Config.CPU,VM.Config.Cloudinit,'
.
'VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,'
- .
'VM.Console,VM.Migrate,VM.Monitor,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback',
+ .
'VM.Console,VM.GuestAgent.Audit,VM.GuestAgent.FileRead,VM.GuestAgent.FileSystemMgmt,'
+ .
'VM.GuestAgent.FileWrite,VM.GuestAgent.Unrestricted,VM.Migrate,VM.Monitor,VM.PowerMgmt,'
+ . 'VM.Snapshot,VM.Snapshot.Rollback',
);
# Administrator -> Permissions.Modify!
check_permission(
@@ -83,7 +85,9 @@ check_permission(
. 'User.Modify,'
.
'VM.Allocate,VM.Audit,VM.Backup,VM.Clone,VM.Config.CDROM,VM.Config.CPU,VM.Config.Cloudinit,'
.
'VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,'
- .
'VM.Console,VM.Migrate,VM.Monitor,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback',
+ .
'VM.Console,VM.GuestAgent.Audit,VM.GuestAgent.FileRead,VM.GuestAgent.FileSystemMgmt,'
+ .
'VM.GuestAgent.FileWrite,VM.GuestAgent.Unrestricted,VM.Migrate,VM.Monitor,VM.PowerMgmt,'
+ . 'VM.Snapshot,VM.Snapshot.Rollback',
);
check_roles('max@pve', '/vms/200', 'storage_manager');
--
2.47.2
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
