Re: [pve-devel] fix #5254: add separate Sys.AccessNetwork privilege

2024-02-23 Thread Fabian Grünbichler
On February 19, 2024 6:14 pm, Thomas Lamprecht wrote: > Adds a new Sys.AccessNetwork privilege that can be used to guard API > endpoints that can do outgoing network requests with (some) user control > over said requests, like e.g. the "download URL to storage" one. > > ## Backstory: > > This ste

Re: [pve-devel] fix #5254: add separate Sys.AccessNetwork privilege

2024-02-20 Thread Hannes Dürr
Tested the patch by 1. * creating a role with 'Datastore.Audit,Datastore.AllocateTemplate,Sys.AccessNetwork' * creating a user with permission for specific {storage} and {node} * downloading the iso via gui 2. * creating a role with 'Datastore.AllocateTemplate,Sys.AccessNetwork' * creatin

Re: [pve-devel] fix #5254: add separate Sys.AccessNetwork privilege

2024-02-19 Thread Thomas Lamprecht
What I forgot to mention: - docs patch is still missing, but would just add an entry for this new priv in the list of existing privileges with a short description - there aren't really hard dependencies between the patches of the different packages, it just won't work, so I do not think we ne

[pve-devel] fix #5254: add separate Sys.AccessNetwork privilege

2024-02-19 Thread Thomas Lamprecht
Adds a new Sys.AccessNetwork privilege that can be used to guard API endpoints that can do outgoing network requests with (some) user control over said requests, like e.g. the "download URL to storage" one. ## Backstory: This stems from an user request [0] w.r.t. the "download image through and U