Console Access requires updateVirtualMachine API privileges

[PaulAngus]

ISSUE TYPE

• Bug Report

COMPONENT NAME

UI

CLOUDSTACK VERSION

4.15+

CONFIGURATION

A role which does not allow the updateVirtualMachine API

OS / ENVIRONMENT

SUMMARY

The console proxy icon is only available when the user has updateVirtualMachine API permission.

cloudstack/ui/src/components/widgets/Console.vue

Line 20 in 75b335e

v-if="['vm', 'systemvm', 'router', 'ilbvm'].includes($route.meta.name) && 'updateVirtualMachine' in $store.getters.apis"

It would be quite common for users not to be allowed to change the properties of a virtual machine while still being allowed to use the VM console.

Tying console access to something like listVirtualMachines would make more sense,

STEPS TO REPRODUCE

Create a role without updateVirtualMachine API permissions. Assign it to an account. sign in as a user in that account and attempt to use the console proxy.

EXPECTED RESULTS

Read-only style user should see console proxy icon

ACTUAL RESULTS

console icon is not visible

[yadvr]

@PaulAngus cc @SadiJr this was a fix likely raised/discussed with you for not allowing read-only admin to access console, refer to apache/cloudstack-primate#467

[PaulAngus]

@rhtyd - I can see that @davidjumani raised the same point as I have just made, and it looks like it was ignored.

This element of the 'security fix' actually makes the VM less secure because a user has to be granted permission to make wide-ranging changes to the VM, just so they can access the console of a VM that they use.

[SadiJr]

@rhtyd - Sorry for the delay in answer.

I agree with @PaulAngus, don't make much sense to me block the console access only to users with permission to updateVirtualMachine API. If the users can list the VMs, why not allow they to access the console?

[yadvr]

I'm fine with whatever the consensus is :)

@PaulAngus - this was originally your issue, during primate SIG a lot of things were discussed over call which I used to collect and log. As I recall your idea was to consider the update API instead of start/stop API such that any role that can update a VM via should be allowed to see the console to make changes in a VM. Before David's fix (https://github.com/apache/cloudstack-primate/pull/469/files) there was no such check and the console button was shown to all roles/buttons. Can you review/LGTM on @SadiJr 's PR #5625