[PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs

[PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs

[Jakob Klocker]

According to the documentation, the protection flag on a container
prevents disk remove and update operations. This is currently not
enforced for the move operation, as reported on the mailing list [0]:
a volume can be moved off a protected CT even though the move removes
it from the source.

VMs are similar, with one difference: the protection flag blocks
removing a disk but still allows adding one. Moving a disk still
removes it from the source, so moving a disk away from a protected VM
should be refused too, but currently is not.

This series adds the missing move checks for both VMs and CTs so the
behavior matches the documentation. For CTs both directions are
checked, since protection also blocks updates; for VMs only the source.

Not addressed here, but raised by Fiona: we may also want to restrict
adding disks to a protected VM, so that protected VMs and CTs behave
identically for disk operations. This would be a change for a major
release though.

[0] https://lore.proxmox.com/all/cf28354b-0ba9-4c59-8f30-2abcb8c23fac@proxmox.com/T/#u


pve-container:

Jakob Klocker (1):
  api: refuse moving volumes if container is protected

 src/PVE/API2/LXC.pm | 14 ++++++++++++++
 1 file changed, 14 insertions(+)


qemu-server:

Jakob Klocker (1):
  api: refuse moving disks if source VM is protected

 src/PVE/API2/Qemu.pm | 5 +++++
 1 file changed, 5 insertions(+)


Summary over all repositories:
  2 files changed, 19 insertions(+), 0 deletions(-)

-- 
Generated by murpp 0.12.0

[PATCH pve-container 1/2] api: refuse moving volumes if container is protected

[Jakob Klocker]

According to the documentation, a protected container will prevent
volume remove/update operations.
Refuse moving a volume if either the target or the source container is
protected.

Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
---
 src/PVE/API2/LXC.pm | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index 88067dd..677eff3 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -2601,6 +2601,11 @@ __PACKAGE__->register_method({
                     die "cannot move volumes of a running container\n"
                         if PVE::LXC::check_running($vmid);
 
+                    PVE::LXC::Config->check_protection(
+                        $conf,
+                        "cannot move volumes of a protected container\n",
+                    );
+
                     if ($mpkey =~ m/^unused\d+$/) {
                         die
                             "cannot move volume '$mpkey', only configured volumes can be moved to "
@@ -2748,6 +2753,15 @@ __PACKAGE__->register_method({
                 PVE::LXC::Config->check_lock($target_conf);
             }
 
+            PVE::LXC::Config->check_protection(
+                $source_conf,
+                "cannot move volumes of a protected container\n",
+            );
+            PVE::LXC::Config->check_protection(
+                $target_conf,
+                "cannot move volumes to a protected container\n",
+            );
+
             die "Can't move volumes from or to template CT\n"
                 if ($source_conf->{template} || $target_conf->{template});
 
-- 
2.47.3

Re: [PATCH pve-container 1/2] api: refuse moving volumes if container is protected

[Michael Köppl]

On Mon Sep 21, 2026 at 5:35 PM CEST, Jakob Klocker wrote:
> According to the documentation, a protected container will prevent
> volume remove/update operations.
> Refuse moving a volume if either the target or the source container is
> protected.
>
> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
> ---
>  src/PVE/API2/LXC.pm | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
>
> diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
> index 88067dd..677eff3 100644
> --- a/src/PVE/API2/LXC.pm
> +++ b/src/PVE/API2/LXC.pm
> @@ -2601,6 +2601,11 @@ __PACKAGE__->register_method({
>                      die "cannot move volumes of a running container\n"
>                          if PVE::LXC::check_running($vmid);
>
> +                    PVE::LXC::Config->check_protection(
> +                        $conf,
> +                        "cannot move volumes of a protected container\n",
> +                    );
> +
>                      if ($mpkey =~ m/^unused\d+$/) {
>                          die
>                              "cannot move volume '$mpkey', only configured volumes can be moved to "
> @@ -2748,6 +2753,15 @@ __PACKAGE__->register_method({
>                  PVE::LXC::Config->check_lock($target_conf);
>              }
>
> +            PVE::LXC::Config->check_protection(
> +                $source_conf,
> +                "cannot move volumes of a protected container\n",
> +            );
> +            PVE::LXC::Config->check_protection(
> +                $target_conf,
> +                "cannot move volumes to a protected container\n",
> +            );

Doesn't this add a second check that was already added with c05243e4?
If the target CT is protected, the second check can never be reached.

> +
>              die "Can't move volumes from or to template CT\n"
>                  if ($source_conf->{template} || $target_conf->{template});
>

[PATCH qemu-server 2/2] api: refuse moving disks if source VM is protected

[Jakob Klocker]

Moving a disk removes it from the source VM, which, according to the
documentation, the protection flag prevents.
Refuse the move when the source is protected.

Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
---
 src/PVE/API2/Qemu.pm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 922c6599..3cf3517b 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -5024,6 +5024,11 @@ __PACKAGE__->register_method({
             my $target_conf = PVE::QemuConfig->load_config($target_vmid);
             PVE::QemuConfig->check_lock($target_conf);
 
+            PVE::QemuConfig->check_protection(
+                $source_conf,
+                "Can't move disks from protected VMs\n",
+            );
+
             die "Can't move disks from or to template VMs\n"
                 if ($source_conf->{template} || $target_conf->{template});
 
-- 
2.47.3

Re: [PATCH qemu-server 2/2] api: refuse moving disks if source VM is protected

[Michael Köppl]

nit: the commit subject reads too broad. This commit only affects moving
disks to another VM. Moving disks to another storage is still possible
even with the --delete flag which removes the old disk. Mostly noticed
this because I initially thought this patch also covers the case where a
disk is moved to another storage.

I'm not entirely sure how to best handle this, though. On the one hand,
moving to another storage with --delete doesn't really remove anything
from the VM in that since, since it attaches the new disk on the new
storage in its place. On the other hand, the behavior then differs
between CTs and VMs. I think the basis for this in the docs saying that
the protection option on CTs prevents "disk remove/update operation"
(which moving a volume to another storage is), whereas the VM docs only
say "This will disable the remove VM and remove disk operations". Still,
wanted to bring it up to clarify the scope of this. Maybe @Fiona can
share her thoughts on this. I suppose if the behavior here should match
the CT behavior, the docs would of course also have to be updated.

On Mon Sep 21, 2026 at 5:35 PM CEST, Jakob Klocker wrote:
> Moving a disk removes it from the source VM, which, according to the
> documentation, the protection flag prevents.
> Refuse the move when the source is protected.
>
> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
> ---
>  src/PVE/API2/Qemu.pm | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
> index 922c6599..3cf3517b 100644
> --- a/src/PVE/API2/Qemu.pm
> +++ b/src/PVE/API2/Qemu.pm
> @@ -5024,6 +5024,11 @@ __PACKAGE__->register_method({
>              my $target_conf = PVE::QemuConfig->load_config($target_vmid);
>              PVE::QemuConfig->check_lock($target_conf);
>
> +            PVE::QemuConfig->check_protection(
> +                $source_conf,
> +                "Can't move disks from protected VMs\n",
> +            );
> +
>              die "Can't move disks from or to template VMs\n"
>                  if ($source_conf->{template} || $target_conf->{template});
>

Re: [PATCH qemu-server 2/2] api: refuse moving disks if source VM is protected

[Fiona Ebner]

Am 22.10.26 um 3:15 PM schrieb Michael Köppl:
> nit: the commit subject reads too broad. This commit only affects moving
> disks to another VM. Moving disks to another storage is still possible
> even with the --delete flag which removes the old disk. Mostly noticed
> this because I initially thought this patch also covers the case where a
> disk is moved to another storage.
> 
> I'm not entirely sure how to best handle this, though. On the one hand,
> moving to another storage with --delete doesn't really remove anything
> from the VM in that since, since it attaches the new disk on the new
> storage in its place. On the other hand, the behavior then differs
> between CTs and VMs. I think the basis for this in the docs saying that
> the protection option on CTs prevents "disk remove/update operation"
> (which moving a volume to another storage is), whereas the VM docs only
> say "This will disable the remove VM and remove disk operations". Still,
> wanted to bring it up to clarify the scope of this. Maybe @Fiona can
> share her thoughts on this. I suppose if the behavior here should match
> the CT behavior, the docs would of course also have to be updated.
> 

I also think it's a bit of a gray area and both sides can be argued for
(more convenient, data is just moved - versus - original volume is
removed, so something is removed). Slightly inclined towards the strict
version like we have for containers, but if we do change it, it should
be done for the next major release, because people might be relying on
the current behavior.

> On Mon Sep 21, 2026 at 5:35 PM CEST, Jakob Klocker wrote:
>> Moving a disk removes it from the source VM, which, according to the
>> documentation, the protection flag prevents.
>> Refuse the move when the source is protected.
>>
>> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
>> ---
>>  src/PVE/API2/Qemu.pm | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
>> index 922c6599..3cf3517b 100644
>> --- a/src/PVE/API2/Qemu.pm
>> +++ b/src/PVE/API2/Qemu.pm
>> @@ -5024,6 +5024,11 @@ __PACKAGE__->register_method({
>>              my $target_conf = PVE::QemuConfig->load_config($target_vmid);
>>              PVE::QemuConfig->check_lock($target_conf);
>>
>> +            PVE::QemuConfig->check_protection(
>> +                $source_conf,
>> +                "Can't move disks from protected VMs\n",
>> +            );
>> +
>>              die "Can't move disks from or to template VMs\n"
>>                  if ($source_conf->{template} || $target_conf->{template});
>>
> 
> 

Re: [PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs

[Michael Köppl]

Thanks for these patches!

Tested the following scenarios:
- Attempted to move a disk from a protected VM to another VM. This was
  denied as expected.
- Moved a disk from an unprotected VM to a protected VM, which worked,
  since adding a disk to a protected VM is not in scope for these
  patches.
- Attempted to move a volume from an unprotected container to a
  protected one as well as from a protected one to an unprotected one.
  Both were denied with "cannot move volumes to a protected container".

Even though the actions above all work as expected, I noticed that the
behavior is different between CTs and VMs regarding moving a disk/volume
to another storage. I'm not entirely sure that's in scope, though. I
added a comment on the qemu-server patch regarding that.

I also looked at the implementation and added comments to the individual
patches.

On Mon Sep 21, 2026 at 5:35 PM CEST, Jakob Klocker wrote:
> According to the documentation, the protection flag on a container
> prevents disk remove and update operations. This is currently not
> enforced for the move operation, as reported on the mailing list [0]:
> a volume can be moved off a protected CT even though the move removes
> it from the source.
>
> VMs are similar, with one difference: the protection flag blocks
> removing a disk but still allows adding one. Moving a disk still
> removes it from the source, so moving a disk away from a protected VM

[snip]

applied: [PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs

[Thomas Lamprecht]

On Mon, 21 Sep 2026 17:35:43 +0200, Jakob Klocker wrote:
> According to the documentation, the protection flag on a container
> prevents disk remove and update operations. This is currently not
> enforced for the move operation, as reported on the mailing list [0]:
> a volume can be moved off a protected CT even though the move removes
> it from the source.
> 
> VMs are similar, with one difference: the protection flag blocks
> removing a disk but still allows adding one. Moving a disk still
> removes it from the source, so moving a disk away from a protected VM
> should be refused too, but currently is not.
> 
> [...]

Applied, thanks!

[pve-container] applied to git/pve-container.git (master)
[1/1] api: refuse moving volumes if container is protected
      commit: f78d591365e4d36c399ebe7cb75ee27cfcdf1369

[qemu-server] applied to qemu-server.git (master)
[1/1] api: refuse moving disks if source VM is protected
      https://git.proxmox.com/?p=qemu-server.git;a=commitdiff;h=b9ea9ee29f5059be027c8612da93efd2bfa97592