proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-10-04 11:32:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

permissions: add ACL paths for SDN fabrics

Browse Source 
Add permission path /sdn/fabrics/{fabric_id}. There are currently only
SDN-specific permissions for the fabric itself, not the nodes. For
displaying / editing the nodes, the existing permissions Sys.Audit or
Sys.Modify on /nodes/{node} are required, because they are already
used for viewing / editing the network configuration of a node.

The node settings mostly revolve around configuring IPs and network
interfaces on that node, so we decided to stick with the permission
that is already governing that, since it would need to be checked when
editing a node anyway. Otherwise, users with access to a fabric node
could change parts of the network configuration of arbitrary
interfaces that node, circumventing the current permission checks. A
separate, SDN-specific, permission would not add much benefit because
of that.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
Link: https://lore.proxmox.com/20250716130837.585796-35-g.goller@proxmox.com
This commit is contained in:
Stefan Hanreich 2025-07-16 15:07:55 +02:00 committed by Thomas Lamprecht
parent 34d524188f
commit 63f71d62c8
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/PVE/AccessControl.pm
View File

@ -1285,6 +1285,8 @@ sub check_path {
|/sdn/controllers/[[:alnum:]\_\-]+
|/sdn/dns
|/sdn/dns/[[:alnum:]]+
|/sdn/fabrics
|/sdn/fabrics/[[:alnum:]]+
|/sdn/ipams
|/sdn/ipams/[[:alnum:]]+
|/sdn/zones