From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 083291FF09C for ; Mon, 19 Oct 2026 13:01:09 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 8F5062168F; Mon, 19 Oct 2026 13:00:39 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Subject: [PATCH manager 3/4] api: backup: extract config: allow access for Datastore.Allocate Date: Mon, 19 Oct 2026 12:57:54 +0200 Message-ID: <20261019110029.92256-4-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261019110029.92256-1-f.ebner@proxmox.com> References: <20261019110029.92256-1-f.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792407633973 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.391 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: CGBFNHSAKDSPTHFHMYAYXW2P6FKD5NVP X-Message-ID-Hash: CGBFNHSAKDSPTHFHMYAYXW2P6FKD5NVP X-MailFrom: f.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The check_volume_access() call checks that the user has 'VM.Backup' for the owning guest's ID or 'Datastore.Allocate' for the storage. The latter is the highest possible storage permission. Consider that enough to extract the configuration even without an explicit 'VM.Backup' permission. Note that for restoring a backup, only the check_volume_access() call is used. So this change also better aligns the checks. Signed-off-by: Fiona Ebner --- PVE/API2/VZDump.pm | 1 - 1 file changed, 1 deletion(-) diff --git a/PVE/API2/VZDump.pm b/PVE/API2/VZDump.pm index 8875070e..98caf1d9 100644 --- a/PVE/API2/VZDump.pm +++ b/PVE/API2/VZDump.pm @@ -308,7 +308,6 @@ __PACKAGE__->register_method({ if (!defined($ownervm)) { die "unable to extract configuration for '$volume' - not a guest backup\n"; } - $rpcenv->check($authuser, "/vms/$ownervm", ['VM.Backup']); } return PVE::Storage::extract_vzdump_config($storage_cfg, $volume); -- 2.47.3