Listing storage content requires write permissions

[crabhi]

Hi, I'm trying to export the disk sizes to monitoring. A token with PVEAuditor role can read almost everything I need but the information about disks. Querying /nodes/{some_node}/storage/local-lvm/content yields an empty list. Calling the API with a more powerful role (e. g. PVEDatastoreAdmin) returns the info.

I'm at the version 7.2-11. Is it a bug or is there a reason why Datastore.Audit should not be able to list disks?

 

[fweber]

Hi, storage contents are filtered according to what the user should be allowed to see. To see a particular VM disk, a user (without Datastore.Allocate) apparently needs not only Datastore.Audit on the storage, but also VM.Config.Disk on the VM: https://git.proxmox.com/?p=pve-stor...8698e53f928f58798b9cf53df6d8019e;hb=HEAD#l535

However, VM.Config.Disk also allows to add/modify/remove disks, and I don't know if there is a way to allow read-only access to VM disks.

 

[crabhi]

Thanks for pointing me to the right permission. I can confirm it works. Unfortunately, this is not ideal for a monitoring tool.

Maybe some maintainer can clarify why the other permission check is needed. The commit by Fabian Eber (@fabian?) is not that old - less than a year.

 

[fabian]

different person, but I can tell you anyhow

there simply is no privilege in-between that would allow seeing, but not using (which equals reading the contents). we try to not add single-use privileges since our ACL system is already quite complex and we don't want to make it even more difficult to understand.

in this case it might be possible to refactor the code somehwat to differentiate between "is allowed to know about" (what you want, maybe replacing VM.Config.Disk with VM.Audit - haven't thought it through yet) vs "is allowed to use" (current check), and then storage content listing (and some other API paths?) could use the new check.

 

[crabhi]

Thanks! That makes sense. I'm not that much familiar with the ACL system but from my point of view, using VM.Audit sounds better. My monitoring role currently uses Sys.Audit,Datastore.Audit,VM.Config.Disk.