[PATCH pve-container] fix #7864: lxc: honour pool privileges when creating containers with tags

[jlcusinato <jlcusinato@neverhack.com>]

From: Jean-Leon CUSINATO <jlcusinato@neverhack.com>

check_ct_modify_config_perm() passes $pool to every other
check_vm_perm() call, but the tags branch called
assert_tag_permissions() without it, so the VM.Config.Options check
always resolved against /vms/$vmid.

Unlike for an existing container, where the pool ACL already resolves
onto /vms/$vmid, the create path is hit: the LXC create API accepts
tags as a config property and hands the raw parameters, including
tags, to check_ct_modify_config_perm() before the container joins the
pool. A caller whose privileges come solely from /pool/<pool>
therefore fails to create containers with tags:

  403 Permission check failed (/vms/<vmid>, VM.Config.Options)

Pass the pool through, matching the neighbouring checks.

Fixes: 7a57f63 ("check_ct_modify_config_perm: check for tags permissions with 'assert_tag_permissions'")
Reported-by: dreadfulbunny <dreadfulbunny@proton.me>
Signed-off-by: Felix Winterhalter <felix@ranovus.com>
---

Compared to the Bugzilla attachment (2058): the 'currently latent'
premise in the original message is wrong - the LXC create API does
accept tags and container create fails the same way (data point in
bug comment #7, 2026-10-27), so the subject now starts with
'fix #7864:' and the message describes the create path;
Fixes:/Reported-by: trailers added. Code identical, rebased onto
current master.

Resend note (submitted by Jean-Léon CUSINATO
<jlcusinato@neverhack.com>):

These patches originate from bug 7864 [0]: code by Felix Winterhalter
<felix@ranovus.com> (the versions attached there, informally reviewed
by a Proxmox maintainer in comment #4, who asked for a posting on this
list) plus crandler's follow-up finding (comment #5) and dreadfulbunny's
data point on the container create path (comment #7). Neither original
author has been active on the bug since September 2026, and the list
never received a posting despite that request, so I am submitting them
here with their attribution intact in the commit messages
(Signed-off-by / Reported-by). All contributors are CCed. My individual
CLA has been submitted to and recorded by Proxmox
(office@proxmox.com, October 2026), who asked for the patches to be
posted here. Not runtime-tested (no test node available); verification
is code-level only. Feedback, especially testing, welcome.

Series merge order: 1) pve-guest-common, then 2) qemu-server and
3) pve-container (the latter two only rely on the new optional $pool
parameter introduced in 1).

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=7864

 src/PVE/LXC.pm | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 44ae4fa..f7c9b5b 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1743,7 +1743,9 @@ sub check_ct_modify_config_perm {
         } elsif ($opt eq 'tags') {
             my $old = $oldconf->{$opt};
             my $new = $delete ? '' : $newconf->{$opt};
-            PVE::GuestHelpers::assert_tag_permissions($vmid, $old, $new, $rpcenv, $authuser);
+            PVE::GuestHelpers::assert_tag_permissions(
+                $vmid, $old, $new, $rpcenv, $authuser, $pool,
+            );
         } else {
             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
         }
-- 
2.56.0