* [pve-devel] [PATCH container 1/3] api: create: default to unprivileged containers
2025-07-30 15:00 [pve-devel] [PATCH container/manager 0/4] restrict privileged containers Fabian Grünbichler
@ 2025-07-30 15:00 ` Fabian Grünbichler
2025-07-30 23:59 ` [pve-devel] applied: " Thomas Lamprecht
2025-07-30 15:00 ` [pve-devel] [PATCH container 2/3] create/restore: require Sys.Modify for privileged containers Fabian Grünbichler
` (2 subsequent siblings)
3 siblings, 1 reply; 9+ messages in thread
From: Fabian Grünbichler @ 2025-07-30 15:00 UTC (permalink / raw)
To: pve-devel
restore keeps what is in the backup config, but allows switching to
unprivileged. switching from unprivileged to privileged requires VM.Allocate at
the moment.
the config schema default cannot easily be changed to unprivileged, as that
would break existing configs.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
src/PVE/API2/LXC.pm | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index a56c441..a247b80 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -252,6 +252,8 @@ __PACKAGE__->register_method({
if ($restore) {
# fixme: limit allowed parameters
+ } else {
+ $unprivileged = 1 if !defined($unprivileged);
}
my $force = extract_param($param, 'force');
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 9+ messages in thread* [pve-devel] [PATCH container 2/3] create/restore: require Sys.Modify for privileged containers
2025-07-30 15:00 [pve-devel] [PATCH container/manager 0/4] restrict privileged containers Fabian Grünbichler
2025-07-30 15:00 ` [pve-devel] [PATCH container 1/3] api: create: default to unprivileged containers Fabian Grünbichler
@ 2025-07-30 15:00 ` Fabian Grünbichler
2025-07-30 23:59 ` [pve-devel] applied: " Thomas Lamprecht
2025-07-30 15:00 ` [pve-devel] [PATCH container 3/3] migration: require Sys.Modify for incoming " Fabian Grünbichler
2025-07-30 15:00 ` [pve-devel] [PATCH manager 1/1] lxc: create: always submit unprivileged field Fabian Grünbichler
3 siblings, 1 reply; 9+ messages in thread
From: Fabian Grünbichler @ 2025-07-30 15:00 UTC (permalink / raw)
To: pve-devel
except for in-place restore where both the current and the backed-up config are
already privileged.
this covers the following cases:
- creating a fresh container: defaults to unprivileged, requires Sys.Modify if set to privileged
- restoring with explicit override of unprivileged value to make the container privileged
- in-place restoring of privileged backup over unprivileged config
- restoring of privileged backup into new container
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
src/PVE/API2/LXC.pm | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index a247b80..951b1c7 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -139,7 +139,8 @@ __PACKAGE__->register_method({
description =>
"You need 'VM.Allocate' permission on /vms/{vmid} or on the VM pool /pool/{pool}. "
. "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. "
- . "You also need 'Datastore.AllocateSpace' permissions on the storage.",
+ . "You also need 'Datastore.AllocateSpace' permissions on the storage. "
+ . "For privileged containers, 'Sys.Modify' permissions on '/' are required.",
},
protected => 1,
proxyto => 'node',
@@ -254,6 +255,7 @@ __PACKAGE__->register_method({
# fixme: limit allowed parameters
} else {
$unprivileged = 1 if !defined($unprivileged);
+ $rpcenv->check($authuser, '/', ['Sys.Modify']) if !$unprivileged;
}
my $force = extract_param($param, 'force');
@@ -289,12 +291,11 @@ __PACKAGE__->register_method({
# since the user is lacking permission to configure the container's FW
$skip_fw_config_restore = 1;
- # error out if a user tries to change from unprivileged to privileged
+ # error out if a user tries to change from unprivileged to privileged without required privileges
# explicit change is checked here, implicit is checked down below or happening in root-only paths
my $conf = PVE::LXC::Config->load_config($vmid);
if ($conf->{unprivileged} && defined($unprivileged) && !$unprivileged) {
- raise_perm_exc(
- "cannot change from unprivileged to privileged without VM.Allocate");
+ $rpcenv->check($authuser, '/', ['Sys.Modify']);
}
} else {
raise_perm_exc();
@@ -442,9 +443,12 @@ __PACKAGE__->register_method({
assert_not_restore_from_external($archive, $storage_cfg)
if !$conf->{unprivileged};
- # implicit privileged change is checked here
- if ($old_conf->{unprivileged} && !$conf->{unprivileged}) {
- $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Allocate']);
+ # implicit privileged change, or creating a new privileged container is checked here
+ if (
+ (!$same_container_exists || $old_conf->{unprivileged})
+ && !$conf->{unprivileged}
+ ) {
+ $rpcenv->check($authuser, '/', ['Sys.Modify']);
}
}
}
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 9+ messages in thread* [pve-devel] [PATCH container 3/3] migration: require Sys.Modify for incoming privileged containers
2025-07-30 15:00 [pve-devel] [PATCH container/manager 0/4] restrict privileged containers Fabian Grünbichler
2025-07-30 15:00 ` [pve-devel] [PATCH container 1/3] api: create: default to unprivileged containers Fabian Grünbichler
2025-07-30 15:00 ` [pve-devel] [PATCH container 2/3] create/restore: require Sys.Modify for privileged containers Fabian Grünbichler
@ 2025-07-30 15:00 ` Fabian Grünbichler
2025-07-30 23:59 ` [pve-devel] applied: " Thomas Lamprecht
2025-07-30 15:00 ` [pve-devel] [PATCH manager 1/1] lxc: create: always submit unprivileged field Fabian Grünbichler
3 siblings, 1 reply; 9+ messages in thread
From: Fabian Grünbichler @ 2025-07-30 15:00 UTC (permalink / raw)
To: pve-devel
an incoming remote migration is akin to a container creation, so treat it the same.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
src/PVE/API2/LXC.pm | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index 951b1c7..2574739 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -3036,6 +3036,7 @@ __PACKAGE__->register_method({
unprivileged => $unprivileged,
arch => $arch,
};
+ $rpcenv->check($authuser, '/', ['Sys.Modify']) if !$unprivileged;
PVE::LXC::check_ct_modify_config_perm(
$rpcenv,
$authuser,
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 9+ messages in thread* [pve-devel] [PATCH manager 1/1] lxc: create: always submit unprivileged field
2025-07-30 15:00 [pve-devel] [PATCH container/manager 0/4] restrict privileged containers Fabian Grünbichler
` (2 preceding siblings ...)
2025-07-30 15:00 ` [pve-devel] [PATCH container 3/3] migration: require Sys.Modify for incoming " Fabian Grünbichler
@ 2025-07-30 15:00 ` Fabian Grünbichler
2025-07-30 23:21 ` [pve-devel] applied: " Thomas Lamprecht
3 siblings, 1 reply; 9+ messages in thread
From: Fabian Grünbichler @ 2025-07-30 15:00 UTC (permalink / raw)
To: pve-devel
even if unchecked, since the backend now defaults to unprivileged if not
defined at all.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
www/manager6/lxc/CreateWizard.js | 1 +
1 file changed, 1 insertion(+)
diff --git a/www/manager6/lxc/CreateWizard.js b/www/manager6/lxc/CreateWizard.js
index 2971991e2..0f6fcce8d 100644
--- a/www/manager6/lxc/CreateWizard.js
+++ b/www/manager6/lxc/CreateWizard.js
@@ -65,6 +65,7 @@ Ext.define('PVE.lxc.CreateWizard', {
xtype: 'proxmoxcheckbox',
name: 'unprivileged',
value: true,
+ uncheckedValue: 0,
bind: {
value: '{unprivileged}',
},
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 9+ messages in thread