From: dreadfulbunny <dreadfulbunny@proton.me>
To: jlcusinato@neverhack.com
Cc: pve-devel@lists.proxmox.com, felix@ranovus.com, crandler@crandland.de
Subject: Re: [PATCH 0/3] fix #7864: allow pool-scoped privileges to create VMs with tags
Date: Tue, 03 Nov 2026 09:45:58 +0000 [thread overview]
Message-ID: <20261103094532.8686-1-dreadfulbunny@proton.me> (raw)
In-Reply-To: <20261027103626.767361-1-jlcusinato@neverhack.com>
Tested the whole series on a Proxmox VE 9.2 node: pve-manager 9.2.21,
libpve-guest-common-perl 6.0.5, qemu-server 9.2.11, pve-container 6.1.14.
I applied the three patches to the installed Perl modules (they apply
with offsets, no fuzz) and restarted pvedaemon and pveproxy; no rebuilt
packages.
Setup: a pool and an API token (privsep=1). The user and the token both
hold only a role with VM.Allocate, VM.Config.* and VM.Audit on
/pool/<pool>, plus PVEDatastoreUser on the rootfs storage and PVEAuditor
on the template storage. Nothing on /vms.
Before the patches:
- POST /nodes/<node>/qemu with pool and tags: the task fails with
"unable to create VM 210 - 403 Permission check failed (/vms/210,
VM.Config.Options)".
- POST /nodes/<node>/lxc with pool and tags: the API call itself
returns "403 Permission check failed (/vms/211, VM.Config.Options)".
- The same container create without tags succeeds.
With the patches:
- Both creates succeed; the guests have the tags and are pool members.
- Setting tags on an existing pool container (PUT
/nodes/<node>/lxc/<vmid>/config) still works.
Not tested: the {} -> '' change in qemu-server, since tag-style
user-allow is at its default ('free') here.
Tested-by: dreadfulbunny <dreadfulbunny@proton.me>
prev parent reply other threads:[~2026-11-03 12:29 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 10:32 [PATCH 0/3] fix #7864: allow pool-scoped privileges to create VMs with tags jlcusinato
2026-10-27 10:32 ` [PATCH pve-guest-common] fix #7864: guest helpers: allow pool-scoped privileges for tag permission checks jlcusinato
2026-10-27 10:32 ` [PATCH qemu-server] fix #7864: api: create vm: honour pool privileges when setting tags jlcusinato
2026-10-27 10:32 ` [PATCH pve-container] fix #7864: lxc: honour pool privileges when creating containers with tags jlcusinato
2026-11-03 9:45 ` dreadfulbunny [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261103094532.8686-1-dreadfulbunny@proton.me \
--to=dreadfulbunny@proton.me \
--cc=crandler@crandland.de \
--cc=felix@ranovus.com \
--cc=jlcusinato@neverhack.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox