From: Fiona Ebner <f.ebner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH container 2/2] api: fix permission check for guest net device without bridge
Date: Tue, 7 Oct 2025 15:03:43 +0200 [thread overview]
Message-ID: <20251007130407.80850-3-f.ebner@proxmox.com> (raw)
In-Reply-To: <20251007130407.80850-1-f.ebner@proxmox.com>
As reported in the community forum [0], changing a guest's network
device definition would fail with an error for non-root users, when
it did not (yet) specify a bridge:
> no sdn vnet ID specified
Skip the call to check_vnet_access() if there is no bridge defined.
Note that editing a device to not use any bridge anymore still
requires permissions for the currently configured bridge even after
this change.
[0]: https://forum.proxmox.com/threads/173249/
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/LXC.pm | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index a445a85..89ccb54 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1662,6 +1662,7 @@ sub check_bridge_access {
my $net = PVE::LXC::Config->parse_lxc_network($raw);
my ($bridge, $tag, $trunks) = $net->@{ 'bridge', 'tag', 'trunks' };
+ next if !defined($bridge); # no vnet to check for
check_vnet_access($rpcenv, $authuser, $bridge, $tag, $trunks);
return 1;
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
prev parent reply other threads:[~2025-10-07 13:04 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-07 13:03 [pve-devel] [PATCH-SERIES qemu-server/container 0/2] " Fiona Ebner
2025-10-07 13:03 ` [pve-devel] [PATCH qemu-server 1/2] " Fiona Ebner
2025-10-07 13:03 ` Fiona Ebner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251007130407.80850-3-f.ebner@proxmox.com \
--to=f.ebner@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.