[pve-devel] [RFC qemu-server 1/1] allow setting ipconfigX with VM.Config.Cloudinit

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

these config keys only affect the cloudinit drive contents (and state of the
guest inside the VM), they are not used anywhere on the hypervisor side, so
they should not require VM.Config.Network (which allows a lot more, such as
changing vNIC VLAN tags or the bridges they are connected to).

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
https://forum.proxmox.com/threads/role-vm-config-networking-prevent-cloud-init-networking.126719
and https://bugzilla.proxmox.com/show_bug.cgi?id=2741 for some prior
discussions..

 PVE/API2/Qemu.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 587bb222..0999a9ef 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -631,9 +631,9 @@ my $check_vm_modify_config_perm = sub {
 	    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.PowerMgmt']);
 	} elsif ($diskoptions->{$opt}) {
 	    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
-	} elsif ($opt =~ m/^(?:net|ipconfig)\d+$/) {
+	} elsif ($opt =~ m/^net\d+$/) {
 	    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
-	} elsif ($cloudinitoptions->{$opt}) {
+	} elsif ($cloudinitoptions->{$opt} || $opt =~ m/^ipconfig\d+$/) {
 	    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Cloudinit', 'VM.Config.Network'], 1);
 	} elsif ($opt eq 'vmstate') {
 	    # the user needs Disk and PowerMgmt privileges to change the vmstate
-- 
2.30.2