On September 20, 2022 2:50 pm, Dominik Csapak wrote:
> Signed-off-by: Dominik Csapak <d.csa...@proxmox.com>
> ---
> PVE/API2/Qemu.pm | 54 ++++++++++++++++++++++++++++++++++++++++++++++--
> 1 file changed, 52 insertions(+), 2 deletions(-)
>
> diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
> index 7afd7a4..d6d393f 100644
> --- a/PVE/API2/Qemu.pm
> +++ b/PVE/API2/Qemu.pm
> @@ -26,6 +26,7 @@ use PVE::QemuServer::Drive;
> use PVE::QemuServer::ImportDisk;
> use PVE::QemuServer::Monitor qw(mon_cmd);
> use PVE::QemuServer::Machine;
> +use PVE::QemuServer::PCI;
> use PVE::QemuServer::USB qw(parse_usb_device);
> use PVE::QemuMigrate;
> use PVE::RPCEnvironment;
> @@ -603,6 +604,26 @@ my $check_vm_create_usb_perm = sub {
> return 1;
> };
>
> +my $check_vm_create_hostpci_perm = sub {
> + my ($rpcenv, $authuser, $vmid, $pool, $param) = @_;
> +
> + return 1 if $authuser eq 'root@pam';
> +
> + foreach my $opt (keys %{$param}) {
> + next if $opt !~ m/^hostpci\d+$/;
> +
> + my $device = PVE::JSONSchema::parse_property_string('pve-qm-hostpci',
> $param->{$opt});
> + if ($device->{host} !~ m/:/) {
while thinking about the priv patch I decided to check out the ACL handling as
well - sorry for not asking earlier about this aspect!
would it make sense to have a prefix for "ID of mapped hardware" instead of
claiming "everything that doesn't contain ':'" as namespace?
the same also applies to the USB ACL checks and the other checks in this patch..
> + $rpcenv->check_full($authuser, "/hardware/$device->{host}",
> ['Hardware.Use']);
this and similar sites would then also be more explicit:
my $hw_id = ..; # extract actual ID
$rpvenv->check_full($authuser, "/hardware/$hw_id", ['Hardware.Use']);
> + $rpcenv->check_vm_perm($authuser, $vmid, $pool,
> ['VM.Config.HWType']);
> + } else {
> + die "only root can set '$opt' config for non-mapped devices\n";
> + }
> + }
> +
> + return 1;
> +};
> +
>
> [...]
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
