proxmox-mirrors/qemu-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu-server synced 2025-10-05 00:59:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

api: create_vm: check serial and usb permissions

Browse Source 
The existing check_vm_modify_config_perm doesn't do so anymore, but
the check only got re-added to the modify/delete paths. See commits
165be267eb and
e30f75c571 for context.

In the future, it might make sense to generalise the
check_vm_modify_config_perm and have it not only take keys, but both
new and old values, and use that generalised function everywhere.

Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Fabian Ebner 2021-03-05 11:29:20 +01:00 committed by Thomas Lamprecht
parent 4dd1e83c75
commit 0761ee013f
1 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
PVE/API2/Qemu.pm
View File

@ -329,6 +329,42 @@ my $cloudinitoptions = {
sshkeys => 1, sshkeys => 1,
}; };
my $check_vm_create_serial_perm = sub {
my ($rpcenv, $authuser, $vmid, $pool, $param) = @_;
return 1 if $authuser eq 'root@pam';
foreach my $opt (keys %{$param}) {
next if $opt !~ m/^serial\d+$/;
if ($param->{$opt} eq 'socket') {
$rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
} else {
die "only root can set '$opt' config for real devices\n";
}
}
return 1;
};
my $check_vm_create_usb_perm = sub {
my ($rpcenv, $authuser, $vmid, $pool, $param) = @_;
return 1 if $authuser eq 'root@pam';
foreach my $opt (keys %{$param}) {
next if $opt !~ m/^usb\d+$/;
if ($param->{$opt} =~ m/spice/) {
$rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
} else {
die "only root can set '$opt' config for real devices\n";
}
}
return 1;
};
my $check_vm_modify_config_perm = sub { my $check_vm_modify_config_perm = sub {
my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_; my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
@ -567,6 +603,9 @@ __PACKAGE__->register_method({
&$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]); &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
&$check_vm_create_serial_perm($rpcenv, $authuser, $vmid, $pool, $param);
&$check_vm_create_usb_perm($rpcenv, $authuser, $vmid, $pool, $param);
&$check_cpu_model_access($rpcenv, $authuser, $param); &$check_cpu_model_access($rpcenv, $authuser, $param);
foreach my $opt (keys %$param) { foreach my $opt (keys %$param) {