Re: [PATCH storage] api: prune backups: dry run: filter volumes based on permissions

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On November 3, 2026 4:14 pm, Fiona Ebner wrote:
> In the API endpoint for the prune backups dry run, filter volumes in
> the result based on permissions using check_volume_access(), similar
> to what the API endpoint for listing storage contents is already
> doing.
> 
> The permission check is based on permissions for the storage and the
> 'VM.Backup' permission for guest IDs, so each backup group is either
> fully absent or fully present in the result.

this now makes the Audit privilege check on the endpoint itself
meaningless?

I think we should either switch this endpoint to do the same check as
the actual pruning does (modulo Audit|AllocateSpace vs just
AllocateSpace), or switch both over to check_volume_access and drop the
Audit part..

> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
>  src/PVE/API2/Storage/PruneBackups.pm | 17 ++++++++++++++++-
>  1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/src/PVE/API2/Storage/PruneBackups.pm b/src/PVE/API2/Storage/PruneBackups.pm
> index 2920c89..60a8182 100644
> --- a/src/PVE/API2/Storage/PruneBackups.pm
> +++ b/src/PVE/API2/Storage/PruneBackups.pm
> @@ -100,6 +100,9 @@ __PACKAGE__->register_method({
>      code => sub {
>          my ($param) = @_;
>  
> +        my $rpcenv = PVE::RPCEnvironment::get();
> +        my $authuser = $rpcenv->get_user();
> +
>          my $cfg = PVE::Storage::config();
>  
>          my $vmid = extract_param($param, 'vmid');
> @@ -110,7 +113,19 @@ __PACKAGE__->register_method({
>          $prune_backups = PVE::JSONSchema::parse_property_string('prune-backups', $prune_backups)
>              if defined($prune_backups);
>  
> -        return PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
> +        my $result = [];
> +        my $prune_list =
> +            PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
> +        for my $prune_entry ($prune_list->@*) {
> +            eval {
> +                PVE::Storage::check_volume_access(
> +                    $rpcenv, $authuser, $cfg, undef, $prune_entry->{volid}, 'backup',
> +                );
> +            };
> +            next if $@;
> +            push $result->@*, $prune_entry;
> +        }
> +        return $result;
>      },
>  });
>  
> -- 
> 2.47.3
> 
> 
> 
> 
> 
>