From 4fb92ae88ae937f3b43b7839b4356b4a6e30a50a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= Date: Wed, 14 Jun 2023 12:42:13 +0200 Subject: [PATCH] node console: restrict all non-login commands to root@pam MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit and not just upgrade. note that the only other non-login command (ceph_install) is restricted to root@pam in the web UI anyway, and that the termproxy endpoint is lacking this check and thus always falls back to a login prompt for non-login commands requested by non-root users. Signed-off-by: Fabian Grünbichler --- PVE/API2/Nodes.pm | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/PVE/API2/Nodes.pm b/PVE/API2/Nodes.pm index 0843c3a3..58fa3f4c 100644 --- a/PVE/API2/Nodes.pm +++ b/PVE/API2/Nodes.pm @@ -949,7 +949,7 @@ __PACKAGE__->register_method ({ node => get_standard_option('pve-node'), cmd => { type => 'string', - description => "Run specific command or default to login.", + description => "Run specific command or default to login (requires 'root\@pam')", enum => [keys %$shell_cmd_map], optional => 1, default => 'login', @@ -1000,7 +1000,7 @@ __PACKAGE__->register_method ({ raise_perm_exc("realm != pam") if $realm ne 'pam'; - if (defined($param->{cmd}) && $param->{cmd} eq 'upgrade' && $user ne 'root@pam') { + if (defined($param->{cmd}) && $param->{cmd} ne 'login' && $user ne 'root@pam') { raise_perm_exc('user != root@pam'); } @@ -1089,7 +1089,7 @@ __PACKAGE__->register_method ({ node => get_standard_option('pve-node'), cmd => { type => 'string', - description => "Run specific command or default to login.", + description => "Run specific command or default to login (requires 'root\@pam')", enum => [keys %$shell_cmd_map], optional => 1, default => 'login', @@ -1223,7 +1223,7 @@ __PACKAGE__->register_method ({ proxy => get_standard_option('spice-proxy', { optional => 1 }), cmd => { type => 'string', - description => "Run specific command or default to login.", + description => "Run specific command or default to login (requires 'root\@pam')", enum => [keys %$shell_cmd_map], optional => 1, default => 'login', @@ -1248,7 +1248,7 @@ __PACKAGE__->register_method ({ raise_perm_exc("realm != pam") if $realm ne 'pam'; - if (defined($param->{cmd}) && $param->{cmd} eq 'upgrade' && $user ne 'root@pam') { + if (defined($param->{cmd}) && $param->{cmd} ne 'login' && $user ne 'root@pam') { raise_perm_exc('user != root@pam'); }