Managing node certificates currently requires broad /nodes/{node}
permissions, which violates the least-privilege principle. This
series adds /nodes/{node}/certificates as a dedicated ACL path and
moves the relevant permission checks onto it, so certificate
management can be done without granting node-wide rights.
The pve-access-control patch registers the new ACL path and must be
applied first. The pve-manager patches depend on it for the API
permission checks and the GUI path selector.
pve-access-control:
Jakob Klocker (1):
fix #7513: acl: allow ACL access to /nodes/{node}/certificates path
src/PVE/AccessControl.pm | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
pve-manager:
Jakob Klocker (2):
fix #7513: api: certs: change ACL on certificates path
fix #7513: ui: perm path store: add per-node certificates ACL path
PVE/API2/ACME.pm | 6 +++---
PVE/API2/Certificates.pm | 4 ++--
www/manager6/data/PermPathStore.js | 11 +++++++++--
3 files changed, 14 insertions(+), 7 deletions(-)
--
2.47.3
