j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 11:16:47 +00:00
Code Issues Projects Releases Wiki Activity
webvirtcloud/doc/permissions.md
catborise be5e37a616 docs: README and doc/ match the code 
- Deleting VMs and moving disks are jobs too (Features, Behavior
  changes, architecture), and the API's delete answers 202.
- Docker keeps the TLS client certificates in webvirtcloud-pki.
- The manual installation covers Ubuntu 26.04 and Debian 13, says lxml
  is reused like libvirt-python, and adds the service user to the
  libvirt and kvm groups, as the installer does, for a socket compute.
- Moving to a new machine starts in the clone's directory (Docker) and
  copies secret_key only when the backup has it (installer); the
  off-site steps run in the panel's checkout; an update's backup also
  holds /etc/default/webvirtcloud and local-migrations.tar.
- A kept settings.py is rebuilt from the template instead of patched by
  a list that had fallen behind (knox, axes, four middlewares).
- gstfsd on 127.0.0.1 serves a panel that adds its compute as localhost;
  LOGIN_TRUSTED_PROXIES matters only for a proxy on another machine;
  socket computes reach a localhost console too.
- New passwords pass Django's validators (Behavior changes).
- permissions: a VM an administrator paused stays paused for owners.
- architecture: nginx listens on 80, on 443 only with your TLS.
- Running tests: the libvirt layer's tests are in vrtManager/tests.
2026-11-06 13:48:04 +03:00

3.2 KiB
Raw Blame History

Users, Roles and Permissions

WebVirtCloud combines three kinds of access rights:

  • Superuser (is_superuser): full administration — computes, storage pools, networks, interfaces, nwfilters, secrets, app settings, users, and every VM.
  • Global permissions (Django permissions, set per user or group in the admin pages):
    • instances.view_instances — read-only auditor role: sees every VM in lists and detail pages, but cannot change them and cannot open their consoles.
    • instances.clone_instances — may clone VMs (see the table for which ones).
    • instances.snapshot_instances — may create, revert and delete snapshots of VMs they may change.
    • instances.passwordless_console — the console page fills in the VNC password automatically (granted to all users by default).
    • accounts.change_password — may change their own password.
  • Per-VM ownership (an owner entry for a user on a VM, managed by a superuser on the VM's page) with three flags: is_change, is_delete, is_vnc. An owner without flags may see, start and stop the VM and open its console.
Action on a VM Superuser Owner Owner flag / permission needed view_instances only
See the VM (list, detail) ✅ ✅ — ✅
Start, shut down, power cycle, force off ✅ ✅ — ❌
Open the console (noVNC, .vv file for virt-viewer, VDI URL) ✅ ✅ — ❌
Resize CPU/memory/disk, set root password, add SSH key, change title/description ✅ ✅ is_change ❌
Change console settings (type, VNC password, keymap) ✅ ✅ is_change and is_vnc ❌
Snapshots ✅ ✅ is_change and instances.snapshot_instances ❌
Clone ✅ ✅ is_change and instances.clone_instances (templates: viewing the template is enough) templates only, with instances.clone_instances
Delete the VM ✅ ✅ is_delete ❌
Disks and media (add, attach, edit, detach, delete volumes; CD-ROM/ISO) ✅ ❌ — ❌
Network interfaces, boot options, vCPU hotplug, autostart, guest agent, suspend/resume, migrate, raw XML, owners ✅ ❌ — ❌

Notes:

  • Only superusers choose disk names and MAC addresses when cloning; for other users the server derives them.
  • is_staff gives no access to VMs and does not reveal console settings or VNC passwords by itself.
  • A VM an administrator paused stays paused for its owners: their power actions on it are refused.
  • A template VM is changed (resize, root password, SSH keys, options, console settings, snapshots) only by superusers and by staff owners with is_change, and deleted only by superusers and staff owners with is_delete; other owners keep view, console and power (power on and power cycle of a template are refused with a warning). Cloning a template needs only view access and instances.clone_instances.
  • On VM pages, users without ownership or view_instances get 404 (the VM's existence is not revealed), and users who can see a VM but lack the right for an action get 403. Superuser-only pages answer 403 to everyone else; the console page answers 403 both for a missing VM and for a VM the user may not open.