[PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs

[PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs

[Jakob Klocker]

According to the documentation, the protection flag on a container
prevents disk remove and update operations. This is currently not
enforced for the move operation, as reported on the mailing list [0]:
a volume can be moved off a protected CT even though the move removes
it from the source.

VMs are similar, with one difference: the protection flag blocks
removing a disk but still allows adding one. Moving a disk still
removes it from the source, so moving a disk away from a protected VM
should be refused too, but currently is not.

This series adds the missing move checks for both VMs and CTs so the
behavior matches the documentation. For CTs both directions are
checked, since protection also blocks updates; for VMs only the source.

Not addressed here, but raised by Fiona: we may also want to restrict
adding disks to a protected VM, so that protected VMs and CTs behave
identically for disk operations. This would be a change for a major
release though.

[0] https://lore.proxmox.com/all/cf28354b-0ba9-4c59-8f30-2abcb8c23fac@proxmox.com/T/#u


pve-container:

Jakob Klocker (1):
  api: refuse moving volumes if container is protected

 src/PVE/API2/LXC.pm | 14 ++++++++++++++
 1 file changed, 14 insertions(+)


qemu-server:

Jakob Klocker (1):
  api: refuse moving disks if source VM is protected

 src/PVE/API2/Qemu.pm | 5 +++++
 1 file changed, 5 insertions(+)


Summary over all repositories:
  2 files changed, 19 insertions(+), 0 deletions(-)

-- 
Generated by murpp 0.12.0

[PATCH pve-container 1/2] api: refuse moving volumes if container is protected

[Jakob Klocker]

According to the documentation, a protected container will prevent
volume remove/update operations.
Refuse moving a volume if either the target or the source container is
protected.

Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
---
 src/PVE/API2/LXC.pm | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index 88067dd..677eff3 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -2601,6 +2601,11 @@ __PACKAGE__->register_method({
                     die "cannot move volumes of a running container\n"
                         if PVE::LXC::check_running($vmid);
 
+                    PVE::LXC::Config->check_protection(
+                        $conf,
+                        "cannot move volumes of a protected container\n",
+                    );
+
                     if ($mpkey =~ m/^unused\d+$/) {
                         die
                             "cannot move volume '$mpkey', only configured volumes can be moved to "
@@ -2748,6 +2753,15 @@ __PACKAGE__->register_method({
                 PVE::LXC::Config->check_lock($target_conf);
             }
 
+            PVE::LXC::Config->check_protection(
+                $source_conf,
+                "cannot move volumes of a protected container\n",
+            );
+            PVE::LXC::Config->check_protection(
+                $target_conf,
+                "cannot move volumes to a protected container\n",
+            );
+
             die "Can't move volumes from or to template CT\n"
                 if ($source_conf->{template} || $target_conf->{template});
 
-- 
2.47.3

[PATCH qemu-server 2/2] api: refuse moving disks if source VM is protected

[Jakob Klocker]

Moving a disk removes it from the source VM, which, according to the
documentation, the protection flag prevents.
Refuse the move when the source is protected.

Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
---
 src/PVE/API2/Qemu.pm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 922c6599..3cf3517b 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -5024,6 +5024,11 @@ __PACKAGE__->register_method({
             my $target_conf = PVE::QemuConfig->load_config($target_vmid);
             PVE::QemuConfig->check_lock($target_conf);
 
+            PVE::QemuConfig->check_protection(
+                $source_conf,
+                "Can't move disks from protected VMs\n",
+            );
+
             die "Can't move disks from or to template VMs\n"
                 if ($source_conf->{template} || $target_conf->{template});
 
-- 
2.47.3