Skip to content

Commit 57adc22

Browse files
author
Bengang Yuan
committed
XSI-2128: Ignore RBAC when destroying internal tasks
When calling `VDI.copy` or `VDI.pool_migrate` with `vm_power_admin` role, xapi may forward the operation to a remote host. In this case, xapi creates a pool session on the remote host and create a new task. When the operation completes, `try_internal_async` uses the user's session to destroy the task that was created by an internal pool session, but the user doesn't have the permission to destory other user's task (task.destroy/any), so it fails. Solution: This is an internal cleanup operation, so it doesn't need user RBAC restriction and checking. Ignore RBAC when destroying internal tasks by calling Db_actions.DB_Action.Task.destroy directly. Signed-off-by: Bengang Yuan <bengang.yuan@citrix.com>
1 parent ba43e00 commit 57adc22

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

ocaml/xapi/helpers.ml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2025,7 +2025,7 @@ let try_internal_async ~__context (marshaller : Rpc.t -> 'b)
20252025
)
20262026
(fun () ->
20272027
info "try_internal_async: destroying task: t = ( %s )" ref ;
2028-
TaskHelper.destroy ~__context t
2028+
Db.Task.destroy ~__context ~self:t
20292029
)
20302030

20312031
module PoolSecret : sig

0 commit comments

Comments
 (0)