From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: Simon LEONARD <git-1001af4@sinux.sh>
Cc: pve-devel@lists.proxmox.com
Subject: Re: [pve-devel] [PATCH container v2 0/1] close #1543: allow low-level lxc config
Date: Mon, 24 Mar 2025 16:01:19 +0100 (CET) [thread overview]
Message-ID: <1177940021.1789.1742828479085@webmail.proxmox.com> (raw)
In-Reply-To: <20250322180647.12941-1-git-1001af4@sinux.sh>
> Simon LEONARD <git-1001af4@sinux.sh> hat am 22.03.2025 19:05 CET geschrieben:
> I added the validify check for each key.
>
> I'm not keen to allow only root@pam to change this setting, as it would
> kill any attempt at automating the container creation via the API.
> But maybe it should be part of a permission?
it needs to be root-only at the moment, because it allows setting a lot
of things that only root is supposed to be able to do:
- various containment features (apparmor, ..)
- arbitrary mounts
- hooks
- ..
most of those don't have an associated privilege and would require
something like 'Sys.Root':
https://bugzilla.proxmox.com/show_bug.cgi?id=2582
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
prev parent reply other threads:[~2025-03-24 15:01 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-23 22:29 [pve-devel] [PATCH container 0/1] close #1543: allow low-level lxc update Simon LEONARD
2025-01-23 22:29 ` [pve-devel] [PATCH container 1/1] " Simon LEONARD
2025-01-27 11:05 ` Fabian Grünbichler
2025-03-22 18:05 ` [pve-devel] [PATCH container v2 0/1] close #1543: allow low-level lxc config Simon LEONARD
2025-03-22 18:05 ` [pve-devel] [PATCH container v2 1/1] close #1543: allow low-level lxc config update Simon LEONARD
2025-03-24 15:01 ` Fabian Grünbichler [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1177940021.1789.1742828479085@webmail.proxmox.com \
--to=f.gruenbichler@proxmox.com \
--cc=git-1001af4@sinux.sh \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.