[Proxmox API] GET /access/permissions returns incorrect permissions for resources contained in pools.

ltcptgeneral

Member
Jun 21, 2022
14
0
21
I have an example user testuser, which is a member of group dmz:
1793394238751.png
Iin ALCs, I have given group dmz a custom PAAS-Client role to /pools/dmz with propogate:
1793394291097.png
Where the custom role has Pool.Audit, Datastore.Audit, VM.Audit, VM.Console, and VM.PowerMgmt
1793394377800.png

But, when I make a GET request to /access/permissions I get:
Code:
{
    "data": {
        "/vms/109": {
            "VM.Audit": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Console": 0,
            "VM.PowerMgmt": 0
        },
        "/pool/dmz": {
            "VM.PowerMgmt": 1,
            "Pool.Audit": 1,
            "Datastore.Audit": 1,
            "VM.Audit": 1,
            "VM.Console": 1
        },
        "/vms/107": {
            "VM.Console": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/storage/cephfs": {
            "VM.PowerMgmt": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Audit": 0,
            "VM.Console": 0
        },
        "/vms/102": {
            "VM.PowerMgmt": 0,
            "VM.Audit": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Console": 0
        },
        "/vms/106": {
            "VM.PowerMgmt": 0,
            "VM.Console": 0,
            "VM.Audit": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0
        },
        "/storage/cephpl_nvme": {
            "VM.Console": 0,
            "VM.Audit": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/vms/103": {
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/vms/105": {
            "VM.PowerMgmt": 0,
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0
        },
        "/vms/108": {            
            "VM.PowerMgmt": 0,
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0
        },
        "/vms/100": {
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/vms/101": {
            "VM.PowerMgmt": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.Console": 0
        },
        "/storage/local": {
            "VM.PowerMgmt": 0,
            "VM.Audit": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Console": 0
        },
        "/vms/999999": {
            "VM.PowerMgmt": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.Console": 0
        }
    }
}

Which shows 0 for the permissions granted through PAAS-Client on /pool/dmz's contained resources, when I would expect 1 for those permissions. The actual permission checking when the user does something (ie audit the VM settings) works as expected.

Is this the intended behavior for the API endpoint?

Proxmox Version: 9.2.24
 
Last edited: