From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 6A1181FF186 for ; Thu, 18 Sep 2025 11:38:47 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 987CD16653; Thu, 18 Sep 2025 11:38:51 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Thu, 18 Sep 2025 11:38:41 +0200 Message-Id: <20250918093842.16059-3-f.ebner@proxmox.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250918093842.16059-1-f.ebner@proxmox.com> References: <20250918093842.16059-1-f.ebner@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1758188317561 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.024 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH qemu-server 2/3] partially fix #6805: api: modify vm config: privilege checks for VM-state-related properties X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Currently, the VM-state-related properties 'runningcpu' and 'runningmachine' are not supposed to end up in the VM configuration of a remote-migratable VM, because a suspended VM is not yet migratable. However, there was a bug and the properties were not removed after cloning from a snapshot, see commit "partially fix #6805: api: clone: properly remove all snapshot-related info". Upon remote migration, the property would be encountered and would be limited to root@pam only. To aid fixing bug #6805, do proper privilege checking for configuration properties related to the running VM state. Note that the 'vmstate' property is already checked for in the check_vm_modify_config_perm() helper. Note that VM-state-related properties cannot be set via API by a user. Originally-by: Thomas Lamprecht Signed-off-by: Fiona Ebner Link: https://lore.proxmox.com/20250917163038.488710-3-f.ebner@proxmox.com (cherry picked from commit 7c05f0be9858543272c1254c83f4dfc266b97fe2) [FE: drop running-nets-host-mtu which does not exist in PVE 8] Signed-off-by: Fiona Ebner --- src/PVE/API2/Qemu.pm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm index 5af117ba..8b990371 100644 --- a/src/PVE/API2/Qemu.pm +++ b/src/PVE/API2/Qemu.pm @@ -721,6 +721,7 @@ my $check_cpu_model_access = sub { my $cpuoptions = { 'cores' => 1, 'cpu' => 1, + 'runningcpu' => 1, 'cpulimit' => 1, 'cpuunits' => 1, 'numa' => 1, @@ -740,6 +741,7 @@ my $hwtypeoptions = { 'hotplug' => 1, 'kvm' => 1, 'machine' => 1, + 'runningmachine' => 1, 'scsihw' => 1, 'smbios1' => 1, 'tablet' => 1, -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel