CA-406402/XSI-2128: Ignore RBAC when destroying internal tasks

[BengangY]

When calling VDI.copy or VDI.pool_migrate with vm_power_admin role, xapi may forward the operation to a remote host. In this case, xapi creates a pool session on the remote host and create a new task. When the operation completes, try_internal_async uses the user's session to destroy the task that was created by an internal pool session, but the user doesn’t have the permission to destory other user’s task (task.destroy/any), so it fails.

Solution:
This is an internal cleanup operation, so it doesn’t need user RBAC restriction and checking. Ignore RBAC when destroying internal tasks by calling Db_actions.DB_Action.Task.destroy directly.

[lindig]

How can we be sure this is only used for internal tasks?

[robhoes]

I think this is correct. The task is indeed created on the remote host, so a non-root context on the coordinator would not be allowed to destroy it. Nice discovery!

[lindig]

I looked at the code again. It is explicit that this is an internal async operation - hence, something that needs a task, which must be cleaned up. I now also believe that this is correct. The code that is being called is:

let destroy ~__context task_id =
  let@ __context = Context.with_tracing ~__context __FUNCTION__ in
  if not (Ref.is_dummy task_id) then (
    assert_op_valid ~ok_if_no_session_in_context:true ~__context task_id ;
    Db_actions.DB_Action.Task.destroy ~__context ~self:task_id
  )

@robhoes comment suggests this could be simplified to Db.Task.destroy as well.

[BengangY]

@robhoes comment suggests this could be simplified to Db.Task.destroy as well.
Thanks. I updated it to Db.Task.destroy.