From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 111CC1FF0B0 for ; Tue, 27 Oct 2026 11:42:21 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 9249E21622; Tue, 27 Oct 2026 11:42:19 +0100 (CET) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793097730; x=1793702530; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bRm2D1v1M9zgRj/9nSzH+dNcPa3sk972PdsBwU0PZaY=; b=tR81QnvXQ/hP1HuEkKJyIgm+1dx9/3lndRq3SZESJhVLz+c5dnn5GeAIl4XP5RFccN 3Y4qh5Od8X1dt8RfpItLu0UokWHvlGjR5IjGsJ7jVnfAYey2Pp1/AaQFWquFgzmnuJox EkyA/TZ4LtFqpGpkjPz9QCIBRCbI5d9UKM3MiC+LfeyEcKMr77PJir7FXGqxkK9VUYMU DS9cs8hNKtl+nDy3pu19YRNIA+C9BxO5trrhKhXS7zZc4oJe7KzyVNlGU2zYUbyyR0Oj yF9xsik4Vj44azZiGEXHEfK9x5CJmHuNcePFGIZzLViOkOGhFdZPa2Uo89RVcvQXOT5f ZTzA== X-Gm-Message-State: AFq9FYJaqJ05/D6Tvp+vbufLRdrt0JRZwvlbdwVy4U2zF5OegXYa9zsb zkxgYNoAm1mFcXgKa2OM4Qa8anuHulk9gnEzAogKpfNt5CsQgrG2r8wmhNBmXvKMjmUF X-Gm-Gg: AYBFou3TGFn8C8E5yOjqWhxGLmqgdbxSjpalCWZe4WWG4EVO0q6923cclDS04sJDdmp Mau5d35o1NT47vLl9t9O/EU+uzPyky7XDfeBRX7vtmBaEcAorc5NwS5ECR9Fq7yVXW4ffBh7GWE IwtsYy12RYWWW+LsIXGoWNYPSvifj+ldn61srLPD1nrrsgwPPuFgtUyig2nLnpjVP4BCIbFcGaH yWkQSqdpKOonAloLZn3zF9bgmmEhPHMdAKduIIUxgztYZRBRxh7RUDP6uGh/49x7P3Pf87zxdD0 4MbG1q0vjj6reUxTU3nVVxHDpawrc9ssSPX9ydRAznALRRaLoizCtBhNabjnUR/0xuJ8jMmwvSd A87Sqm35VPwdIC9BtSr1GO3qxaEHBTBAxWoc/z7UoMpPGkjk98tzPcAlMOCqrqle9wS0I6rnwM2 zMR3K9rVwQM1jZpWDEskVGhUJVD9lYxFVrLjPRuPnrtEapJ7bvhbBGTsLtt22bd/VWBXi7F0NfT o1wL83ulMnguCtA5h+Te6G95JjIviyieLNoVKxw8+cQ/z8/QvVmDAqbgJH9TgU1dmc4g0W/RmzV N1U1zqEOROUrQz16IJXsAz4/GJRyM20J93zBm/V2B9n2ko2B9lEdleo= X-Received: by 2002:a05:600c:a03:b0:4a1:d992:9476 with SMTP id 5b1f17b1804b1-4a35ac9f30dmr182655145e9.23.1793097407063; Tue, 27 Oct 2026 03:36:47 -0700 (PDT) From: jlcusinato To: pve-devel@lists.proxmox.com Subject: [PATCH 0/3] fix #7864: allow pool-scoped privileges to create VMs with tags Date: Tue, 27 Oct 2026 11:32:32 +0100 Message-ID: <20261027103626.767361-1-jlcusinato@neverhack.com> X-Mailer: git-send-email 2.56.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Level: 4 Message-ID-Hash: X7EX52PWVUYFKFYNQHHS67RKD4GMUKJL X-Message-ID-Hash: X7EX52PWVUYFKFYNQHHS67RKD4GMUKJL X-MailFrom: jean.leon.cusinato@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: felix@ranovus.com, crandler@crandland.de, dreadfulbunny@proton.me X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Pool-scoped automation can create VMs and containers in its pool, but the create fails as soon as --tags is passed (403 on /vms/, VM.Config.Options); regressed with commit a929b3e ("vm_create: check tag permissions if setting tags") in qemu-server and its pve-container counterpart 7a57f63 ("check_ct_modify_config_perm: check for tags permissions with 'assert_tag_permissions'"). Root cause and reproducer: bug 7864 [0]. These are the patches already attached there (code by Felix Winterhalter , all three contributors CCed), posted per the maintainers' request (comment #6); neither has been active on the bug since September 2026 and the list never received a posting, hence this submission. crandler's fix for the {} -> '' defect (comment #5) is rolled into the qemu-server patch; the pve-container message was corrected after dreadfulbunny's data point (comment #7) showed that container create is affected too. Provenance is preserved in the commit messages (Signed-off-by / Reported-by); my individual CLA is on record with Proxmox (October 2026). Merge order: pve-guest-common first; qemu-server and pve-container then. Per-patch notes describe deltas from the Bugzilla versions. Not runtime-tested (no test node); testing feedback welcome. [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7864