From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id AD1BB1FF09C for ; Mon, 19 Oct 2026 13:00:51 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C624F21635; Mon, 19 Oct 2026 13:00:38 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Subject: [PATCH storage 1/4] pvesm: extractconfig: allow access for Datastore.Allocate Date: Mon, 19 Oct 2026 12:57:52 +0200 Message-ID: <20261019110029.92256-2-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261019110029.92256-1-f.ebner@proxmox.com> References: <20261019110029.92256-1-f.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792407633818 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.388 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: SIGCP3LHZKJUFEPYULCSOB4ZGRWF7LQ6 X-Message-ID-Hash: SIGCP3LHZKJUFEPYULCSOB4ZGRWF7LQ6 X-MailFrom: f.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The check_volume_access() call checks that the user has 'VM.Backup' for the owning guest's ID or 'Datastore.Allocate' for the storage. The latter is the highest possible storage permission. Consider that enough to extract the configuration even without an explicit 'VM.Backup' permission. Note that for restoring a backup, only the check_volume_access() call is used. So this change also better aligns the checks. Signed-off-by: Fiona Ebner --- src/PVE/CLI/pvesm.pm | 1 - 1 file changed, 1 deletion(-) diff --git a/src/PVE/CLI/pvesm.pm b/src/PVE/CLI/pvesm.pm index 1aaa9f3..4b42734 100755 --- a/src/PVE/CLI/pvesm.pm +++ b/src/PVE/CLI/pvesm.pm @@ -187,7 +187,6 @@ __PACKAGE__->register_method({ if (!defined($ownervm)) { die "unable to extract configuration for '$volume' - not a guest backup\n"; } - $rpcenv->check($authuser, "/vms/$ownervm", ['VM.Backup']); } my $config_raw = PVE::Storage::extract_vzdump_config($storage_cfg, $volume); -- 2.47.3