From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 7C6D91FF0B0 for ; Tue, 27 Oct 2026 11:43:10 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 1C4A821690; Tue, 27 Oct 2026 11:43:07 +0100 (CET) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793097778; x=1793702578; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=WStJlmQeJnEoNXTWWHKXtvGa986ncuWGlVD6LP4BGo4=; b=KITK7M8Ir0NGx0HKfQ7HLJH/+DYiNHPXiA1KEqJVQrbWc191XoZIKRWFIs6Nm+AxA8 7R/Mup1vFGIs1sxHXB1lqp3H1d8RD0sZbhNoNz7lqrQf6CtLhbotbn7BiQ993qKrqgyD OYt+OV842nS+kCzxntJVqJsLLe1OWYD9wmXYNc0dVRj84ZudD1gglEglgUVfY3e2fD/L 63qyUvDVmvICPXcgmIlrfe1PoUb1LKzOz0zjcLg9y7Pb1Ev3FzLNVnpmFXmK/T1GVNlJ K06Fg2qkgJP2FsdxxC8OP885cJI1CBjyXYe8mBM1fMUDcO1VLzge9CAauq0VfsWrOYjR Wprg== X-Gm-Message-State: AFq9FYKhG7GouXOfGvyEoDnldzIAs/eJFJK6W4waaZVevfx47GNEjxMb 4egI0PMg+SeKe3cbo+vb9RL4s3QKtdpQsXjvajPnRSOCnhH3g8Sym8npuZ2oPJxQjkD2 X-Gm-Gg: AYBFou1iuefO56X0c2aTFpYD462zIdHJD74yySd2JX4AkAPEJOGI+DVA5hw5btFKNBr KKE+KATwvlJ/b5dmWUZ4YLmfJrYHlsPmdtm4Vep7Dqr7eMVcFfu51Ga/qypeFWY3wyZlnTquOeF 8wtTlJ52VIbdM82m/Ii1mQsPzZ1KhS+VezsdM0DDgCqJYaktudbPJkXEAKtiHKaIwJikIr/W6NW nCb6eKPCo/ebGK7MtB8CFSKIfFt/FFIvoaZDjH5cBZ6S8W0m8lwEPtHZf+r0gISHaYmcgUO6RbA huEyk4EMZV0ZTovcAutXOlkW6u/NfHcq6+j3GsDT7jj8FbrBJS5hhRlq1UPkSe+5QM1mTdXGXgk wyEkrrafQjsO6nfiWavNeukJVcy695nc64ugR5mHjlOd8Le7+Hu9CrFL4xeHun71fyBsj4PMYqG VkbuOUJmHZUExig818ZxyPF9KjmXPSDTALwMJAeahtsNTMtCj/QJ/o8uEUtkY+xkepYc1Wpt3ki BC5Fo1FhI3sxjYyydZ/HPctJVnxoeSZu1Fz3PP62pbomJjwv+LOCcUsA4NIcUYOynMF2wwqq9sq 4KtNs4FO5J1SH+oRSRXWn7fR4F6gNLMnjXufgxKGHDqpim49cy+RDQI= X-Received: by 2002:a05:600c:3d08:b0:4a2:1960:6fa with SMTP id 5b1f17b1804b1-4a7bfec49damr48322035e9.4.1793097407612; Tue, 27 Oct 2026 03:36:47 -0700 (PDT) From: jlcusinato To: pve-devel@lists.proxmox.com Subject: [PATCH pve-guest-common] fix #7864: guest helpers: allow pool-scoped privileges for tag permission checks Date: Tue, 27 Oct 2026 11:32:33 +0100 Message-ID: <20261027103626.767361-2-jlcusinato@neverhack.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261027103626.767361-1-jlcusinato@neverhack.com> References: <20261027103626.767361-1-jlcusinato@neverhack.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Level: 4 Message-ID-Hash: OQXABBMCSIYQ4TBCGHTYFR2UFNDJTDIH X-Message-ID-Hash: OQXABBMCSIYQ4TBCGHTYFR2UFNDJTDIH X-MailFrom: jean.leon.cusinato@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: felix@ranovus.com, crandler@crandland.de, dreadfulbunny@proton.me X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Jean-Leon CUSINATO assert_tag_permissions() hardcoded the pool argument of check_vm_perm() to undef, so the VM.Config.Options check always resolved against /vms/$vmid. That is fine for callers acting on an existing guest, because the pool ACL is resolved onto /vms/$vmid by RPCEnvironment::compile_acl_path(). It is not fine while a guest is being created: at that point the guest is not a member of the pool yet, so a caller whose privileges come solely from /pool/ has nothing on /vms/$vmid to match against. Add an optional $pool parameter and forward it, so callers that know the target pool can opt in. Existing callers pass no pool and keep the current behaviour. Signed-off-by: Felix Winterhalter --- Same code as the Bugzilla attachment (2056), rebased onto current master. Subject now starts with 'fix #7864:' per the developer documentation, and the commit message is reflowed to the 72-char line-width guideline; no semantic changes. Resend note (submitted by Jean-Léon CUSINATO ): These patches originate from bug 7864 [0]: code by Felix Winterhalter (the versions attached there, informally reviewed by a Proxmox maintainer in comment #4, who asked for a posting on this list) plus crandler's follow-up finding (comment #5) and dreadfulbunny's data point on the container create path (comment #7). Neither original author has been active on the bug since September 2026, and the list never received a posting despite that request, so I am submitting them here with their attribution intact in the commit messages (Signed-off-by / Reported-by). All contributors are CCed. My individual CLA has been submitted to and recorded by Proxmox (office@proxmox.com, October 2026), who asked for the patches to be posted here. Not runtime-tested (no test node available); verification is code-level only. Feedback, especially testing, welcome. Series merge order: 1) pve-guest-common, then 2) qemu-server and 3) pve-container (the latter two only rely on the new optional $pool parameter introduced in 1). [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7864 src/PVE/GuestHelpers.pm | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/PVE/GuestHelpers.pm b/src/PVE/GuestHelpers.pm index f8d112b..72da542 100644 --- a/src/PVE/GuestHelpers.pm +++ b/src/PVE/GuestHelpers.pm @@ -310,11 +310,15 @@ sub get_allowed_tags { # checks the permissions for setting/updating/removing tags for guests # tagopt_old and tagopt_new expect the tags as they are in the config # +# $pool is optional and only relevant while the guest is being created, where +# the guest is not a member of the pool yet, so the pool ACL cannot yet be +# resolved onto /vms/$vmid. Callers acting on an existing guest can omit it. +# # either returns gracefully or raises a permission exception sub assert_tag_permissions { - my ($vmid, $tagopt_old, $tagopt_new, $rpcenv, $authuser) = @_; + my ($vmid, $tagopt_old, $tagopt_new, $rpcenv, $authuser, $pool) = @_; - $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Options']); + $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']); my $privileged_user = $rpcenv->check($authuser, '/', ['Sys.Modify'], 1) // 0; -- 2.56.0