[PATCH storage] api: prune backups: dry run: filter volumes based on permissions

[PATCH storage] api: prune backups: dry run: filter volumes based on permissions

[Fiona Ebner]

In the API endpoint for the prune backups dry run, filter volumes in
the result based on permissions using check_volume_access(), similar
to what the API endpoint for listing storage contents is already
doing.

The permission check is based on permissions for the storage and the
'VM.Backup' permission for guest IDs, so each backup group is either
fully absent or fully present in the result.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/API2/Storage/PruneBackups.pm | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/PVE/API2/Storage/PruneBackups.pm b/src/PVE/API2/Storage/PruneBackups.pm
index 2920c89..60a8182 100644
--- a/src/PVE/API2/Storage/PruneBackups.pm
+++ b/src/PVE/API2/Storage/PruneBackups.pm
@@ -100,6 +100,9 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
+        my $rpcenv = PVE::RPCEnvironment::get();
+        my $authuser = $rpcenv->get_user();
+
         my $cfg = PVE::Storage::config();
 
         my $vmid = extract_param($param, 'vmid');
@@ -110,7 +113,19 @@ __PACKAGE__->register_method({
         $prune_backups = PVE::JSONSchema::parse_property_string('prune-backups', $prune_backups)
             if defined($prune_backups);
 
-        return PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
+        my $result = [];
+        my $prune_list =
+            PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
+        for my $prune_entry ($prune_list->@*) {
+            eval {
+                PVE::Storage::check_volume_access(
+                    $rpcenv, $authuser, $cfg, undef, $prune_entry->{volid}, 'backup',
+                );
+            };
+            next if $@;
+            push $result->@*, $prune_entry;
+        }
+        return $result;
     },
 });
 
-- 
2.47.3

Re: [PATCH storage] api: prune backups: dry run: filter volumes based on permissions

[Fabian Grünbichler]

On November 3, 2026 4:14 pm, Fiona Ebner wrote:
> In the API endpoint for the prune backups dry run, filter volumes in
> the result based on permissions using check_volume_access(), similar
> to what the API endpoint for listing storage contents is already
> doing.
> 
> The permission check is based on permissions for the storage and the
> 'VM.Backup' permission for guest IDs, so each backup group is either
> fully absent or fully present in the result.

this now makes the Audit privilege check on the endpoint itself
meaningless?

I think we should either switch this endpoint to do the same check as
the actual pruning does (modulo Audit|AllocateSpace vs just
AllocateSpace), or switch both over to check_volume_access and drop the
Audit part..

> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
>  src/PVE/API2/Storage/PruneBackups.pm | 17 ++++++++++++++++-
>  1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/src/PVE/API2/Storage/PruneBackups.pm b/src/PVE/API2/Storage/PruneBackups.pm
> index 2920c89..60a8182 100644
> --- a/src/PVE/API2/Storage/PruneBackups.pm
> +++ b/src/PVE/API2/Storage/PruneBackups.pm
> @@ -100,6 +100,9 @@ __PACKAGE__->register_method({
>      code => sub {
>          my ($param) = @_;
>  
> +        my $rpcenv = PVE::RPCEnvironment::get();
> +        my $authuser = $rpcenv->get_user();
> +
>          my $cfg = PVE::Storage::config();
>  
>          my $vmid = extract_param($param, 'vmid');
> @@ -110,7 +113,19 @@ __PACKAGE__->register_method({
>          $prune_backups = PVE::JSONSchema::parse_property_string('prune-backups', $prune_backups)
>              if defined($prune_backups);
>  
> -        return PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
> +        my $result = [];
> +        my $prune_list =
> +            PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
> +        for my $prune_entry ($prune_list->@*) {
> +            eval {
> +                PVE::Storage::check_volume_access(
> +                    $rpcenv, $authuser, $cfg, undef, $prune_entry->{volid}, 'backup',
> +                );
> +            };
> +            next if $@;
> +            push $result->@*, $prune_entry;
> +        }
> +        return $result;
>      },
>  });
>  
> -- 
> 2.47.3
> 
> 
> 
> 
> 
> 

superseded: [PATCH storage] api: prune backups: dry run: filter volumes based on permissions

[Fiona Ebner]

superseded-by:
https://lore.proxmox.com/pve-devel/20261105103736.52417-1-f.ebner@proxmox.com/