From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 73BB91FF0B0 for ; Tue, 27 Oct 2026 11:43:02 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id EC3F12165E; Tue, 27 Oct 2026 11:43:00 +0100 (CET) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793097778; x=1793702578; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Fswo4vua6blyRAqTfyCsy0bTeSDIUYwoH/0IBnq+Krk=; b=L2aFGU7yfkGQQhxewjMTVC6EhZFkgsereFLPY9udM2X+o89sy5msjwCvLOs9ijrrOA YhU/u76gkH2bfjW3HzMNynTKgFdiVlNrjg7QXarAw+Elf2iSLWECeRECE9ZDpVE6saB8 G5mWJeI49pAR+ZPKKQlGoUnY423/M2nDoqq6dPjud3SmSDweHBUILsoDlRFJ8YdpRgMx iMJ8ujxZkQZCq/oRP6X/svqJge8jnf036nO35DhvSaJYa3GjoSDCfDapAZbB3k0x5kpB nbMpsNDKOiJIadNc1EsOmxsm/vkK0GHFPgkqUiYlWBCrHPYi7fk2ehdhDrPiJ3BzEBV8 IwQA== X-Gm-Message-State: AFq9FYJ98LRwZMYj5GfEq9ZjHlMNBEEj5NizNd2yBxEV9lT9sWDC6dtN D3Fc3YWTbumko68eeLVDxW8INfskmCB4S0J/8sq6zx2wW7UVym2mt8naaG0m1PoxnfBr X-Gm-Gg: AYBFou2Efn5a6AdeSdp/+WTcRP7E2wxl+T8LJ0bolQ+yqwVFlhrgX4IVX1T7vk5bqXO yvd0xMU2OAom2lhP6+/dSeV3cIQnygz3g5U5AiD1+rzAbZLaV31phapZOxsR/ZjO7476wADpuG4 a7531O0lRCyL4w3eiEspQjmxqDCT/Xo1mKL+xgun7cxSziMC4pwygFAIomPC38mh/vI86re17Mi 5zK359G9W8xHCDHFQWbdg6Hif7PbXjFNjfn/hNQd4nMUh2s4k1Sxwu747gW7181osYr5qlys1yy wvtVciUcMGC0mhn2f0PBUnrvaJLwbio0d9f4ODL0yDiPtPT2YCgM/XgWTpWq085fd8z18zTroWS fi6cpfnUABzxoH97muU9k2X9MqaPhvpayxegTlq7w3K0vm3OjQMXCy34zG/npTw9ltxBYliXicp SJk1DJrnC/IV9GJT8F2oWkne4CNoLtuFiCK0t733We0DMshQaEQuV48xyiF+JEtpmWnYbcroQj6 Vj2GrGitWQtJVGgBz1E8zXM0GnihZyrGLjyJ8z5OkE7CSCtaJdvNGQTav5664gHeeBxayzyvHIR 5deLJa8EITjMXNTqXAXP2bJDwN2GEW43NInJww4+9qH8xCbz/2P/yiY= X-Received: by 2002:a05:600c:4ece:b0:4a1:fbd2:f689 with SMTP id 5b1f17b1804b1-4a35ac9d100mr170621695e9.7.1793097408709; Tue, 27 Oct 2026 03:36:48 -0700 (PDT) From: jlcusinato To: pve-devel@lists.proxmox.com Subject: [PATCH pve-container] fix #7864: lxc: honour pool privileges when creating containers with tags Date: Tue, 27 Oct 2026 11:32:35 +0100 Message-ID: <20261027103626.767361-4-jlcusinato@neverhack.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261027103626.767361-1-jlcusinato@neverhack.com> References: <20261027103626.767361-1-jlcusinato@neverhack.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Level: 4 Message-ID-Hash: 6R36AKEWVGSGWDQ3RAFGSXKBIVGWEDZJ X-Message-ID-Hash: 6R36AKEWVGSGWDQ3RAFGSXKBIVGWEDZJ X-MailFrom: jean.leon.cusinato@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: felix@ranovus.com, crandler@crandland.de, dreadfulbunny@proton.me X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Jean-Leon CUSINATO check_ct_modify_config_perm() passes $pool to every other check_vm_perm() call, but the tags branch called assert_tag_permissions() without it, so the VM.Config.Options check always resolved against /vms/$vmid. Unlike for an existing container, where the pool ACL already resolves onto /vms/$vmid, the create path is hit: the LXC create API accepts tags as a config property and hands the raw parameters, including tags, to check_ct_modify_config_perm() before the container joins the pool. A caller whose privileges come solely from /pool/ therefore fails to create containers with tags: 403 Permission check failed (/vms/, VM.Config.Options) Pass the pool through, matching the neighbouring checks. Fixes: 7a57f63 ("check_ct_modify_config_perm: check for tags permissions with 'assert_tag_permissions'") Reported-by: dreadfulbunny Signed-off-by: Felix Winterhalter --- Compared to the Bugzilla attachment (2058): the 'currently latent' premise in the original message is wrong - the LXC create API does accept tags and container create fails the same way (data point in bug comment #7, 2026-10-27), so the subject now starts with 'fix #7864:' and the message describes the create path; Fixes:/Reported-by: trailers added. Code identical, rebased onto current master. Resend note (submitted by Jean-Léon CUSINATO ): These patches originate from bug 7864 [0]: code by Felix Winterhalter (the versions attached there, informally reviewed by a Proxmox maintainer in comment #4, who asked for a posting on this list) plus crandler's follow-up finding (comment #5) and dreadfulbunny's data point on the container create path (comment #7). Neither original author has been active on the bug since September 2026, and the list never received a posting despite that request, so I am submitting them here with their attribution intact in the commit messages (Signed-off-by / Reported-by). All contributors are CCed. My individual CLA has been submitted to and recorded by Proxmox (office@proxmox.com, October 2026), who asked for the patches to be posted here. Not runtime-tested (no test node available); verification is code-level only. Feedback, especially testing, welcome. Series merge order: 1) pve-guest-common, then 2) qemu-server and 3) pve-container (the latter two only rely on the new optional $pool parameter introduced in 1). [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7864 src/PVE/LXC.pm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm index 44ae4fa..f7c9b5b 100644 --- a/src/PVE/LXC.pm +++ b/src/PVE/LXC.pm @@ -1743,7 +1743,9 @@ sub check_ct_modify_config_perm { } elsif ($opt eq 'tags') { my $old = $oldconf->{$opt}; my $new = $delete ? '' : $newconf->{$opt}; - PVE::GuestHelpers::assert_tag_permissions($vmid, $old, $new, $rpcenv, $authuser); + PVE::GuestHelpers::assert_tag_permissions( + $vmid, $old, $new, $rpcenv, $authuser, $pool, + ); } else { $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']); } -- 2.56.0