see individual patches for in-depth review of changes, some broader remarks: - I am missing info about parts you looked at but left as-is (and rationale for why those parts stay root only) - especially relevant would be a list of currently unqualified/root-only-by-default API endpoints and actions taken or not taken + reasons
e.g. some parts that are missing that I found with random grepping (in addition to stuff I mentioned in my other replies), where I have no idea whether you even look at them and decided they are okay as-is, or missed them: - PVE::API2::Backup (tmpdir, dumpdir, script parameters) - PVE::API2::VZDump (maxfiles prune-backups tmpdir dumpdir script bwlimit ionice) - PVE::API2::ClusterConfig (we talked about that off-list, but some mention in the actual patch series would still be good) - PVE::Storage::check_volume_access , which is used in quite a few places.. On February 8, 2022 2:10 pm, Oguz Bektas wrote: > "SuperUser" (henceforth referred as SU) privilege allows to give > root-only permissions to API users, enabling them to perform privileged > actions on behalf of root@pam. > > this privilege is enabled by default for "root@pam", and also mapped > inside "SuperAdministrator" (referred as SA) > > changes from RFC (thanks for the review fabian g.!): > * manager: allow SAs to see/edit certain things on GUI > * qemu-server: also check the required non-root > VM privileges along with the SU priv > * pve-container: adapted error messages, changed variable name to > "is_superuser" for better clarity (in comparison to prev. "is_root" > which is a bit confusing) > * access-control: TFA permissions adaptation for SAs > > > access-control: > > Oguz Bektas (2): > add "SuperAdministrator" role with the new "SuperUser" privilege > tfa: allow superusers to edit root@pam tfa > > src/PVE/API2/TFA.pm | 7 +++++-- > src/PVE/AccessControl.pm | 9 ++++++--- > src/PVE/RPCEnvironment.pm | 2 +- > 3 files changed, 12 insertions(+), 6 deletions(-) > > container: > > Oguz Bektas (1): > fix #2582: api: add checks for 'SuperUser' privilege for root-only > options > > src/PVE/API2/LXC.pm | 13 ++++++------- > src/PVE/API2/LXC/Status.pm | 8 ++++++-- > src/PVE/LXC.pm | 9 ++++++--- > 3 files changed, 18 insertions(+), 12 deletions(-) > > manager: > > Oguz Bektas (1): > change 'root@pam' checks with 'SuperUser' capability check > > www/manager6/Utils.js | 3 ++- > www/manager6/dc/Config.js | 2 +- > www/manager6/dc/UserView.js | 2 +- > www/manager6/lxc/Options.js | 2 +- > www/manager6/lxc/Resources.js | 2 +- > www/manager6/node/Config.js | 2 +- > www/manager6/window/Migrate.js | 4 ++-- > 7 files changed, 9 insertions(+), 8 deletions(-) > > qemu-server: > > Oguz Bektas (1): > add SuperUser privilege checks for root-only options > > PVE/API2/Qemu.pm | 119 +++++++++++++++++++++++++++++------------------ > 1 file changed, 73 insertions(+), 46 deletions(-) > > -- > 2.30.2 > > > _______________________________________________ > pve-devel mailing list > pve-devel@lists.proxmox.com > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel > > > _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
