tyler/proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

verify jobs: add permissions

Browse Source 
equivalent to verifying a whole datastore, except for reading job
(entries), which is accessible to regular Datastore.Audit/Backup users
as well.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
This commit is contained in:
Fabian Grünbichler 2020-10-30 12:36:40 +01:00 committed by Thomas Lamprecht
parent 09f6a24078
commit b7ce2e575f
1 changed files with 39 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
src/api2/config/verify.rs
View File

@ -2,10 +2,17 @@ use anyhow::{bail, Error};
use serde_json::Value; use serde_json::Value;
use ::serde::{Deserialize, Serialize}; use ::serde::{Deserialize, Serialize};
use proxmox::api::{api, Router, RpcEnvironment}; use proxmox::api::{api, Permission, Router, RpcEnvironment};
use proxmox::tools::fs::open_file_locked; use proxmox::tools::fs::open_file_locked;
use crate::api2::types::*; use crate::api2::types::*;
use crate::config::acl::{
PRIV_DATASTORE_AUDIT,
PRIV_DATASTORE_BACKUP,
PRIV_DATASTORE_VERIFY,
};
use crate::config::verify::{self, VerificationJobConfig}; use crate::config::verify::{self, VerificationJobConfig};
#[api( #[api(
@ -17,6 +24,12 @@ use crate::config::verify::{self, VerificationJobConfig};
type: Array, type: Array,
items: { type: verify::VerificationJobConfig }, items: { type: verify::VerificationJobConfig },
}, },
access: {
permission: &Permission::Privilege(
&["datastore", "{store}"],
PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP | PRIV_DATASTORE_VERIFY,
true),
},
)] )]
/// List all verification jobs /// List all verification jobs
pub fn list_verification_jobs( pub fn list_verification_jobs(
@ -61,7 +74,13 @@ pub fn list_verification_jobs(
schema: VERIFICATION_SCHEDULE_SCHEMA, schema: VERIFICATION_SCHEDULE_SCHEMA,
}, },
} }
} },
access: {
permission: &Permission::Privilege(
&["datastore", "{store}"],
PRIV_DATASTORE_VERIFY,
true),
},
)] )]
/// Create a new verification job. /// Create a new verification job.
pub fn create_verification_job(param: Value) -> Result<(), Error> { pub fn create_verification_job(param: Value) -> Result<(), Error> {
@ -97,6 +116,12 @@ pub fn create_verification_job(param: Value) -> Result<(), Error> {
description: "The verification job configuration.", description: "The verification job configuration.",
type: verify::VerificationJobConfig, type: verify::VerificationJobConfig,
}, },
access: {
permission: &Permission::Privilege(
&["datastore", "{store}"],
PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP | PRIV_DATASTORE_VERIFY,
true),
},
)] )]
/// Read a verification job configuration. /// Read a verification job configuration.
pub fn read_verification_job( pub fn read_verification_job(
@ -167,6 +192,12 @@ pub enum DeletableProperty {
}, },
}, },
}, },
access: {
permission: &Permission::Privilege(
&["datastore", "{store}"],
PRIV_DATASTORE_VERIFY,
true),
},
)] )]
/// Update verification job config. /// Update verification job config.
pub fn update_verification_job( pub fn update_verification_job(
@ -238,6 +269,12 @@ pub fn update_verification_job(
}, },
}, },
}, },
access: {
permission: &Permission::Privilege(
&["datastore", "{store}"],
PRIV_DATASTORE_VERIFY,
true),
},
)] )]
/// Remove a verification job configuration /// Remove a verification job configuration
pub fn delete_verification_job(id: String, digest: Option<String>) -> Result<(), Error> { pub fn delete_verification_job(id: String, digest: Option<String>) -> Result<(), Error> {