This series allows users who have been granted Mapping.Use (or Mapping.Modify / Mapping.Audit) on a specific PCI mapping to list the mediated device (mdev) types for that mapping without requiring global Sys.Audit or Sys.Modify privileges on the entire cluster.
In multi‑team environments where access is compartmentalized via resource pools and PCI mappings, the previous requirement forced administrators to grant overly broad permissions for GPU usage. By checking mapping‑specific permissions when a mapping name is supplied, the patch enables non‑administrative users to select and use vGPU types for their assigned hardware. Patch 1/2 makes the necessary logical change for fixing #6735. Patch 2/2 utilizes a new constant parameter for the `pci_scan` endpoint Changes v3->v4 -------------- * factor out global permissions into constant * de-rerence global permissions array when passing it to `raise_perm_exc` * add optional second patch to utilize global permissions constant for `pci_scan` endpoint Changes v2->v3 -------------- * re-introduce else-statement in API handler * move permissions checks into respective logical branches (previously sepate sesection before core code) * update commit message Changes v1->v2 -------------- * Allow all users in the declarative API permissions. * Implement ACL check in API handler by calling check_any and raise_perm_exc. * Remove else statement in API handler, since return statement provides implicit branching * update commit message Previous Versions ----------------- v3: https://lore.proxmox.com/pve-devel/[email protected]/ v2: https://lore.proxmox.com/pve-devel/[email protected]/ v1: https://lore.proxmox.com/pve-devel/[email protected]/ Summary of Changes ------------------ Elias Huhsovitz (2): fix #6735: api: pci: allow mdevscan access via mapping permissions api: pci: utilize constant perm variable for pci_scan PVE/API2/Hardware/PCI.pm | 47 ++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 12 deletions(-) -- 2.47.3
