Proxmox/pve-access-control
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-access-control.git synced 2025-01-03 01:17:55 +03:00
Code Releases Activity

fix #1148: allow up to three levels of pool nesting

Browse Source 
with ACLs being inherited along the pool hierarchy.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
This commit is contained in:
Fabian Grünbichler 2023-11-20 08:22:39 +01:00 committed by Wolfgang Bumiller
parent 401e32056e
commit e7224f6e30
3 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/PVE/AccessControl.pm
View File

@ -1264,7 +1264,7 @@ sub check_path {
|/nodes
|/nodes/[[:alnum:]\.\-\_]+
|/pool
|/pool/[[:alnum:]\.\-\_]+
|/pool/[A-Za-z0-9\.\-_]+(?:/[A-Za-z0-9\.\-_]+){0,2}
|/sdn
|/sdn/controllers
|/sdn/controllers/[[:alnum:]\_\-]+
@ -1318,8 +1318,14 @@ PVE::JSONSchema::register_format('pve-poolid', \&verify_poolname);
sub verify_poolname {
my ($poolname, $noerr) = @_;
if ($poolname !~ m/^[A-Za-z0-9\.\-_]+$/) {
if (split("/", $poolname) > 3) {
die "pool name '$poolname' nested too deeply (max levels = 3)\n" if !$noerr;
return undef;
}
# also adapt check_path above if changed!
if ($poolname !~ m!^[A-Za-z0-9\.\-_]+(?:/[A-Za-z0-9\.\-_]+){0,2}$!) {
die "pool name '$poolname' contains invalid characters\n" if !$noerr;
return undef;

16
src/test/perm-test6.pl
View File

@ -75,6 +75,22 @@ check_roles('User4@pve', '/vms/500', '');
# with pool
check_permissions('User4@pve', '/vms/500', '');
# without pool, checking no access on parent pool
check_roles('intern@pve', '/vms/600', '');
# once more, with VM in nested pool
check_roles('intern@pve', '/vms/700', '');
# with propagated ACL
check_roles('User4@pve', '/vms/700', '');
# with pool, checking no access on parent pool
check_permissions('intern@pve', '/vms/600', '');
# once more, with VM in nested pool
check_permissions('intern@pve', '/vms/700', 'VM.Audit');
# with propagated ACL
check_permissions('User4@pve', '/vms/700', 'VM.Console');
# check nested pool permissions
check_roles('intern@pve', '/pool/marketing/interns', 'RoleINTERN');
check_roles('User4@pve', '/pool/marketing/interns', 'RoleMARKETING');
check_permissions('User1@pve', '/vms/600', 'VM.Console');
check_permissions('User2@pve', '/vms/600', 'VM.Console');

5
src/test/test6.cfg
View File

@ -2,16 +2,20 @@ user:User1@pve:1:
user:User2@pve:1:
user:User3@pve:1:
user:User4@pve:1:
user:intern@pve:1:
group:DEVEL:User1@pve,User2@pve,User3@pve:
group:MARKETING:User1@pve,User4@pve:
group:INTERNS:intern@pve:
role:RoleDEVEL:VM.PowerMgmt:
role:RoleMARKETING:VM.Console:
role:RoleINTERN:VM.Audit:
role:RoleTEST1:VM.Console:
acl:1:/pool/devel:@DEVEL:RoleDEVEL:
acl:1:/pool/marketing:@MARKETING:RoleMARKETING:
acl:1:/pool/marketing/interns:@INTERNS:RoleINTERN:
acl:1:/vms:@DEVEL:RoleTEST1:
acl:1:/vms:User3@pve:NoAccess:
@ -19,3 +23,4 @@ acl:1:/vms/300:@MARKETING:RoleTEST1:
pool:devel:MITS development:500,501,502:store1 store2:
pool:marketing:MITS marketing:600:store1:
pool:marketing/interns:MITS marketing intern:700:store3: