From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9])
by lore.proxmox.com (Postfix) with ESMTPS id 1FBF01FF176
for <inbox@lore.proxmox.com>; Fri, 7 Feb 2025 17:38:51 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 8903110B4C;
Fri, 7 Feb 2025 17:38:48 +0100 (CET)
From: Fiona Ebner <f.ebner@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Fri, 7 Feb 2025 17:38:13 +0100
Message-Id: <20250207163813.97461-1-f.ebner@proxmox.com>
X-Mailer: git-send-email 2.39.5
MIME-Version: 1.0
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.046 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more
information.
RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more
information.
RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more
information.
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
information. [proxmox.com, lxc.pm]
Subject: [pve-devel] [PATCH container] api: config: permission checks: fix
check for 'nesting' feature
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: pve-devel-bounces@lists.proxmox.com
Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com>
As reported in the community forum [0], remote migration for a container
with 'features: nesting=0' would fail with a confusing error message
> changing feature flags (except nesting) is only allowed for root@pam
This is because of a faulty check during container creation that would
only detect 'nesting=1', but not 'nesting=0'. Fix it by properly
checking if only the 'nesting' property is affected via an 'exists'
check for the hash key.
The check for deleting the feature is also broken, so fix it too.
The check for modifying the feature already works correctly.
[0]: https://forum.proxmox.com/threads/161432/
Fixes: 88ef170 ("allow nesting to be changed for VM.Allocate on unprivileged containers")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/LXC.pm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 4d20645..64f8564 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1474,7 +1474,7 @@ sub check_ct_modify_config_perm {
}
} else {
# new container or no features defined
- if (scalar(keys %$features) == 1 && $features->{nesting}) {
+ if (scalar(keys %$features) == 1 && exists($features->{nesting})) {
$nesting_changed = 1;
} elsif (scalar(keys %$features) > 0) {
$other_changed = 1;
@@ -1482,7 +1482,7 @@ sub check_ct_modify_config_perm {
}
} else {
my $features = PVE::LXC::Config->parse_features($oldconf->{$opt});
- if (scalar(keys %$features) == 1 && $features->{nesting}) {
+ if (scalar(keys %$features) == 1 && exists($features->{nesting})) {
$nesting_changed = 1;
} elsif (scalar(keys %$features) > 0) {
$other_changed = 1;
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel