From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id E97F71FF09C for ; Mon, 21 Sep 2026 17:36:08 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id D6775215CC; Mon, 21 Sep 2026 17:35:50 +0200 (CEST) From: Jakob Klocker To: pve-devel@lists.proxmox.com Subject: [PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs Date: Mon, 21 Sep 2026 17:35:43 +0200 Message-ID: <20260921153545.406664-1-j.klocker@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 1 AWL -0.692 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: NB2QPKEKQXOP7HHOMJ5IDHZFEM76UXM7 X-Message-ID-Hash: NB2QPKEKQXOP7HHOMJ5IDHZFEM76UXM7 X-MailFrom: jklocker@dev.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: According to the documentation, the protection flag on a container prevents disk remove and update operations. This is currently not enforced for the move operation, as reported on the mailing list [0]: a volume can be moved off a protected CT even though the move removes it from the source. VMs are similar, with one difference: the protection flag blocks removing a disk but still allows adding one. Moving a disk still removes it from the source, so moving a disk away from a protected VM should be refused too, but currently is not. This series adds the missing move checks for both VMs and CTs so the behavior matches the documentation. For CTs both directions are checked, since protection also blocks updates; for VMs only the source. Not addressed here, but raised by Fiona: we may also want to restrict adding disks to a protected VM, so that protected VMs and CTs behave identically for disk operations. This would be a change for a major release though. [0] https://lore.proxmox.com/all/cf28354b-0ba9-4c59-8f30-2abcb8c23fac@proxmox.com/T/#u pve-container: Jakob Klocker (1): api: refuse moving volumes if container is protected src/PVE/API2/LXC.pm | 14 ++++++++++++++ 1 file changed, 14 insertions(+) qemu-server: Jakob Klocker (1): api: refuse moving disks if source VM is protected src/PVE/API2/Qemu.pm | 5 +++++ 1 file changed, 5 insertions(+) Summary over all repositories: 2 files changed, 19 insertions(+), 0 deletions(-) -- Generated by murpp 0.12.0