proxmox-mirrors/qemu-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu-server synced 2025-10-04 19:20:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor: check_mapping_access: move root user check to the top

Browse Source 
Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
This commit is contained in:
Filip Schauer 2025-02-18 12:10:57 +01:00 committed by Fabian Grünbichler
parent 6b192cb536
commit 4040caa8f3
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
PVE/QemuServer.pm
View File

@ -6435,12 +6435,14 @@ sub check_bridge_access {
sub check_mapping_access { sub check_mapping_access {
my ($rpcenv, $user, $conf) = @_; my ($rpcenv, $user, $conf) = @_;
return 1 if $user eq 'root@pam';
for my $opt (keys $conf->%*) { for my $opt (keys $conf->%*) {
if ($opt =~ m/^usb\d+$/) { if ($opt =~ m/^usb\d+$/) {
my $device = PVE::JSONSchema::parse_property_string('pve-qm-usb', $conf->{$opt}); my $device = PVE::JSONSchema::parse_property_string('pve-qm-usb', $conf->{$opt});
if (my $host = $device->{host}) { if (my $host = $device->{host}) {
die "only root can set '$opt' config for real devices\n" die "only root can set '$opt' config for real devices\n"
if $host !~ m/^spice$/i && $user ne 'root@pam'; if $host !~ m/^spice$/i;
} elsif ($device->{mapping}) { } elsif ($device->{mapping}) {
$rpcenv->check_full($user, "/mapping/usb/$device->{mapping}", ['Mapping.Use']); $rpcenv->check_full($user, "/mapping/usb/$device->{mapping}", ['Mapping.Use']);
} else { } else {
@ -6449,7 +6451,7 @@ sub check_mapping_access {
} elsif ($opt =~ m/^hostpci\d+$/) { } elsif ($opt =~ m/^hostpci\d+$/) {
my $device = PVE::JSONSchema::parse_property_string('pve-qm-hostpci', $conf->{$opt}); my $device = PVE::JSONSchema::parse_property_string('pve-qm-hostpci', $conf->{$opt});
if ($device->{host}) { if ($device->{host}) {
die "only root can set '$opt' config for non-mapped devices\n" if $user ne 'root@pam'; die "only root can set '$opt' config for non-mapped devices\n";
} elsif ($device->{mapping}) { } elsif ($device->{mapping}) {
$rpcenv->check_full($user, "/mapping/pci/$device->{mapping}", ['Mapping.Use']); $rpcenv->check_full($user, "/mapping/pci/$device->{mapping}", ['Mapping.Use']);
} else { } else {