tyler/proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

api2/tape/restore: factor out check_datastore_privs

Browse Source 
so that we can reuse it

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
This commit is contained in:
Dominik Csapak 2021-05-05 12:09:13 +02:00 committed by Dietmar Maurer
parent 2e41dbe828
commit c4a04b7c62
1 changed files with 25 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
src/api2/tape/restore.rs
View File

@ -157,6 +157,30 @@ impl DataStoreMap {
} }
} }
fn check_datastore_privs(
user_info: &CachedUserInfo,
store: &str,
auth_id: &Authid,
owner: &Option<Authid>,
) -> Result<(), Error> {
let privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
if (privs & PRIV_DATASTORE_BACKUP) == 0 {
bail!("no permissions on /datastore/{}", store);
}
if let Some(ref owner) = owner {
let correct_owner = owner == auth_id
|| (owner.is_token() && !auth_id.is_token() && owner.user() == auth_id.user());
// same permission as changing ownership after syncing
if !correct_owner && privs & PRIV_DATASTORE_MODIFY == 0 {
bail!("no permission to restore as '{}'", owner);
}
}
Ok(())
}
pub const ROUTER: Router = Router::new().post(&API_METHOD_RESTORE); pub const ROUTER: Router = Router::new().post(&API_METHOD_RESTORE);
#[api( #[api(
@ -212,20 +236,7 @@ pub fn restore(
} }
for store in used_datastores.iter() { for store in used_datastores.iter() {
let privs = user_info.lookup_privs(&auth_id, &["datastore", &store]); check_datastore_privs(&user_info, &store, &auth_id, &owner)?;
if (privs & PRIV_DATASTORE_BACKUP) == 0 {
bail!("no permissions on /datastore/{}", store);
}
if let Some(ref owner) = owner {
let correct_owner = owner == &auth_id
|| (owner.is_token() && !auth_id.is_token() && owner.user() == auth_id.user());
// same permission as changing ownership after syncing
if !correct_owner && privs & PRIV_DATASTORE_MODIFY == 0 {
bail!("no permission to restore as '{}'", owner);
}
}
} }
let privs = user_info.lookup_privs(&auth_id, &["tape", "drive", &drive]); let privs = user_info.lookup_privs(&auth_id, &["tape", "drive", &drive]);