[SOLVED] "script":"Only root may set this option."

[g0ha]

In PVE5 we could'n add serial port via user, only via root, in PVE6 it became possible.
In PVE6 (6.2-11), method --script in api call "/api2/json/nodes/{node}/vzdump" executed under admin user causes the same error: {"data":null,"errors":{"script":"Only root may set this option."}}
Can we expect liberalization ?

 

[fabian]

no, the hook script runs as root, allowing arbitrary users to execute arbitrary code like that would be bad

 

[g0ha]

Am i right, that workaround for it - using root tokens from PVE6.2?

 

[fabian]

usually people only set that option globally (in vzdump.cfg) or in cron jobs/timer units for scheduled backups (which is CLI, und thus already restricted to root@pam).

 

[g0ha]

I understand, i'm using it too in /etc/vzdump.conf. But if i run backup task for single vm from api - task won't read vzdump.conf
Please explain how i can use new feature from PVE6.2 - API Token.
Refer to manual: "To use an API token, set the HTTP header Authorization to the displayed value of the form PVEAPIToken=USER@REALM!TOKENID=UUID when making API requests"
In https://pve.proxmox.com/wiki/Proxmox_VE_API unfortunately, no section about this feature.
Should i receive PVEAuthCookie?

I create token from web, for user root, named it test, copy secret, then I tried:
curl --header 'Authorization="PVEAPIToken=root@pam!test=UUID"'
curl -d "PVEAPIToken=root@pam!test=UUID"
how is it correct?

 

[fabian]

curl -H 'Authorization: PVEAPITOKEN=root@pam!test=XXX' ... should work (where XXX is the UUID representing the token). IIRC, the code path is the same for scheduled vzdump calls and API vzdump calls and for single or multiple VMs..

 

[g0ha]

curl -H 'Authorization: PVEAPITOKEN=root@pam!test=XXX' ... should work (where XXX is the UUID representing the token).

cool, it works

 

[g0ha]

IIRC, the code path is the same for scheduled vzdump calls and API vzdump calls and for single or multiple VMs..

Yep, rechecked my vzdump.conf, find errors (dumpdir owerlaps with storage options, dumpdir wins). My bad, it works fine. Thank you.

 

[fabian]

that option is actually limited to the full 'root@pam' user, see https://bugzilla.proxmox.com/show_bug.cgi?id=2582

 

[lastingRespector]

Wow Fabian, thx for the quick reply. I had removed my question and made a new thread, being this thread was 'solved'. But hey, super thx.

Now to find out how to make the call using PVEAuthCookie and getting the ticket to populate my curl post line automatically in Bash. Its a puzzle I am willing to try and solve ;-)

 

[lastingRespector]

The original question that fabian answered to and progress can be found in this new thread:

https://forum.proxmox.com/threads/a...this-option-while-using-root-api-token.98819/