From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 49E551FF165 for ; Thu, 17 Jul 2025 15:37:12 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 1C30E3B229; Thu, 17 Jul 2025 15:37:50 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Thu, 17 Jul 2025 15:36:55 +0200 Message-ID: <20250717133711.84715-8-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.2 In-Reply-To: <20250717133711.84715-1-f.ebner@proxmox.com> References: <20250717133711.84715-1-f.ebner@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.028 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH manager 7/9] pve8to9: check for to-be-dropped VM.Monitor privilege in custom roles X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Signed-off-by: Fiona Ebner --- PVE/CLI/pve8to9.pm | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/PVE/CLI/pve8to9.pm b/PVE/CLI/pve8to9.pm index 0c7cb97f..b0e09c6d 100644 --- a/PVE/CLI/pve8to9.pm +++ b/PVE/CLI/pve8to9.pm @@ -768,9 +768,21 @@ sub check_custom_pool_roles { for my $role (sort keys %{$roles}) { next if PVE::AccessControl::role_is_special($role); $custom_roles++; + + $need_handling++ if $roles->{$role}->{'VM.Monitor'}; } if ($need_handling > 0) { - log_fail("$need_handling custom role(s) need handling"); + log_notice( + "Proxmox VE 9 replaced the ambiguously named 'VM.Monitor' privilege with 'Sys.Audit'" + . " for QEMU HMP monitor access and new dedicated 'VM.GuestAgent.*' privileges" + . " for access to a VM's guest agent. The guest agent sub-privileges are 'Audit'" + . " for all informational commands, 'FileRead' and 'FileWrite' for file-read and" + . " file-write, 'FileSystemMgmt' for filesystem freeze, thaw and trim, and" + . " 'Unrestricted' for everything, including command execution. Operations that" + . " affect the VM runstate require 'VM.PowerMgmt' or 'VM.GuestAgent.Unrestricted'"); + log_fail( + "$need_handling custom role(s) use the to-be-dropped 'VM.Monitor' privilege and need" + . " to be adapted after the upgrade"); } elsif ($custom_roles > 0) { log_pass("none of the $custom_roles custom roles need handling"); } else { -- 2.47.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel