proxmox-mirrors/qemu-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu-server synced 2025-08-05 20:36:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix #1811: allow non root user to edit serialX: socket entries

Browse Source 
use VM.Config.HWType for 'socket' and root@pam for real serial devices

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
This commit is contained in:
Dominik Csapak 2019-04-11 13:39:49 +02:00 committed by Thomas Lamprecht
parent f0dbdb6896
commit e545304343
1 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
PVE/API2/Qemu.pm
View File

@ -302,7 +302,7 @@ my $cloudinitoptions = {
}; };
my $check_vm_modify_config_perm = sub { my $check_vm_modify_config_perm = sub {
my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_; my ($rpcenv, $authuser, $vmid, $pool, $key_list, $values) = @_;
return 1 if $authuser eq 'root@pam'; return 1 if $authuser eq 'root@pam';
@ -330,6 +330,14 @@ my $check_vm_modify_config_perm = sub {
$rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']); $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
} elsif ($cloudinitoptions->{$opt} || ($opt =~ m/^(?:net|ipconfig)\d+$/)) { } elsif ($cloudinitoptions->{$opt} || ($opt =~ m/^(?:net|ipconfig)\d+$/)) {
$rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']); $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
} elsif ($opt =~ m/^serial\d+$/) {
if ($values && $values->{$opt} eq 'socket') {
$rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
} elsif (!$values) {
next; # deletion will be checked later since we do not have the config here
} else {
die "only root can set '$opt' config to real devices\n";
}
} else { } else {
# catches usb\d+, hostpci\d+, args, lock, etc. # catches usb\d+, hostpci\d+, args, lock, etc.
# new options will be checked here # new options will be checked here
@ -517,7 +525,7 @@ __PACKAGE__->register_method({
&$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage); &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
&$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]); &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param], $param);
foreach my $opt (keys %$param) { foreach my $opt (keys %$param) {
if (PVE::QemuServer::is_valid_drivename($opt)) { if (PVE::QemuServer::is_valid_drivename($opt)) {
@ -1127,7 +1135,7 @@ my $update_vm_api = sub {
&$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]); &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
&$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]); &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param], $param);
&$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param); &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
@ -1190,6 +1198,14 @@ my $update_vm_api = sub {
if defined($conf->{pending}->{$opt}); if defined($conf->{pending}->{$opt});
PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force); PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
PVE::QemuConfig->write_config($vmid, $conf); PVE::QemuConfig->write_config($vmid, $conf);
} elsif ($opt =~ m/^serial\d$/) {
if ($conf->{$opt} eq 'socket') {
$rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.HWType']);
} elsif ($authuser ne 'root@pam') {
die "only root can delete '$opt' config for real devices\n";
}
PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
PVE::QemuConfig->write_config($vmid, $conf);
} else { } else {
PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force); PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
PVE::QemuConfig->write_config($vmid, $conf); PVE::QemuConfig->write_config($vmid, $conf);