[PATCH pve-guest-common] fix #7864: guest helpers: allow pool-scoped privileges for tag permission checks

[jlcusinato <jlcusinato@neverhack.com>]

From: Jean-Leon CUSINATO <jlcusinato@neverhack.com>

assert_tag_permissions() hardcoded the pool argument of
check_vm_perm() to undef, so the VM.Config.Options check always
resolved against /vms/$vmid.

That is fine for callers acting on an existing guest, because the
pool ACL is resolved onto /vms/$vmid by
RPCEnvironment::compile_acl_path(). It is not fine while a guest is
being created: at that point the guest is not a member of the pool
yet, so a caller whose privileges come solely from /pool/<pool> has
nothing on /vms/$vmid to match against.

Add an optional $pool parameter and forward it, so callers that know
the target pool can opt in. Existing callers pass no pool and keep
the current behaviour.

Signed-off-by: Felix Winterhalter <felix@ranovus.com>
---

Same code as the Bugzilla attachment (2056), rebased onto current
master. Subject now starts with 'fix #7864:' per the developer
documentation, and the commit message is reflowed to the 72-char
line-width guideline; no semantic changes.

Resend note (submitted by Jean-Léon CUSINATO
<jlcusinato@neverhack.com>):

These patches originate from bug 7864 [0]: code by Felix Winterhalter
<felix@ranovus.com> (the versions attached there, informally reviewed
by a Proxmox maintainer in comment #4, who asked for a posting on this
list) plus crandler's follow-up finding (comment #5) and dreadfulbunny's
data point on the container create path (comment #7). Neither original
author has been active on the bug since September 2026, and the list
never received a posting despite that request, so I am submitting them
here with their attribution intact in the commit messages
(Signed-off-by / Reported-by). All contributors are CCed. My individual
CLA has been submitted to and recorded by Proxmox
(office@proxmox.com, October 2026), who asked for the patches to be
posted here. Not runtime-tested (no test node available); verification
is code-level only. Feedback, especially testing, welcome.

Series merge order: 1) pve-guest-common, then 2) qemu-server and
3) pve-container (the latter two only rely on the new optional $pool
parameter introduced in 1).

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=7864

 src/PVE/GuestHelpers.pm | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/PVE/GuestHelpers.pm b/src/PVE/GuestHelpers.pm
index f8d112b..72da542 100644
--- a/src/PVE/GuestHelpers.pm
+++ b/src/PVE/GuestHelpers.pm
@@ -310,11 +310,15 @@ sub get_allowed_tags {
 # checks the permissions for setting/updating/removing tags for guests
 # tagopt_old and tagopt_new expect the tags as they are in the config
 #
+# $pool is optional and only relevant while the guest is being created, where
+# the guest is not a member of the pool yet, so the pool ACL cannot yet be
+# resolved onto /vms/$vmid. Callers acting on an existing guest can omit it.
+#
 # either returns gracefully or raises a permission exception
 sub assert_tag_permissions {
-    my ($vmid, $tagopt_old, $tagopt_new, $rpcenv, $authuser) = @_;
+    my ($vmid, $tagopt_old, $tagopt_new, $rpcenv, $authuser, $pool) = @_;
 
-    $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Options']);
+    $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 
     my $privileged_user = $rpcenv->check($authuser, '/', ['Sys.Modify'], 1) // 0;
 
-- 
2.56.0