From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id E35C61FF0AA for ; Tue, 03 Nov 2026 13:29:14 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4BDAE218F6; Tue, 03 Nov 2026 13:28:48 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=proton.me; s=kidfo5uz2jdnjb4thezjlja7jy.protonmail2; t=1793699163; x=1793958363; bh=AsIIl2gXQd8o7Gh1EWXhf/lGHI3qWIJryWOOB0GrrKk=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=Srzjy1TiEB6eo1UOTSoG5Lm+X0B89my03ky/6VcsqCGB1VwIinRap8J7G9t/0CTIu 55xJi4iMsvqXwu4xWo85kQDKOk+ZKYa/0rTn9fig9FZkwwYx1RklXA0kn91TkoACsf mgfuke0WCa5wewj/qPUO70qsH9iUpskoh6t0sIRaaVehi18S/fVsNAJ+VsdJMXpIGs lw54E2IUDiJ4VLRp86HWSZ3lKxN/oEU9+/96qbfi0XRHdDBEM/gJk5w1PENm/FvAHL xB47la4K9D8QRhEAI6/9EZs0aXm7HzHtnf2RlNMU+7PSfOf/t9jrSGDkxBcSH7xkpp +LP9XCX4P19fA== Date: Tue, 03 Nov 2026 09:45:58 +0000 To: jlcusinato@neverhack.com From: dreadfulbunny Subject: Re: [PATCH 0/3] fix #7864: allow pool-scoped privileges to create VMs with tags Message-ID: <20261103094532.8686-1-dreadfulbunny@proton.me> In-Reply-To: <20261027103626.767361-1-jlcusinato@neverhack.com> References: <20261027103626.767361-1-jlcusinato@neverhack.com> Feedback-ID: 136198016:user:proton X-Pm-Message-ID: 9f918c57275733a66d7dd9c8f780c6ab86c64f78 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-SPAM-LEVEL: Spam detection results: 0 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider KAM_INFOUSMEBIZ 0.75 Prevalent use of .info|.us|.me|.me.uk|.biz|xyz|id|rocks|life domains in spam/malware POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: dreadfulbunny@proton.me X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: WYWZKIG4E42T2FYKXFPT27XSWXGRLI4V X-Message-ID-Hash: WYWZKIG4E42T2FYKXFPT27XSWXGRLI4V X-Mailman-Approved-At: Tue, 03 Nov 2026 13:28:36 +0100 CC: pve-devel@lists.proxmox.com, felix@ranovus.com, crandler@crandland.de X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Tested the whole series on a Proxmox VE 9.2 node: pve-manager 9.2.21, libpve-guest-common-perl 6.0.5, qemu-server 9.2.11, pve-container 6.1.14. I applied the three patches to the installed Perl modules (they apply with offsets, no fuzz) and restarted pvedaemon and pveproxy; no rebuilt packages. Setup: a pool and an API token (privsep=3D1). The user and the token both hold only a role with VM.Allocate, VM.Config.* and VM.Audit on /pool/, plus PVEDatastoreUser on the rootfs storage and PVEAuditor on the template storage. Nothing on /vms. Before the patches: - POST /nodes//qemu with pool and tags: the task fails with "unable to create VM 210 - 403 Permission check failed (/vms/210, VM.Config.Options)". - POST /nodes//lxc with pool and tags: the API call itself returns "403 Permission check failed (/vms/211, VM.Config.Options)". - The same container create without tags succeeds. With the patches: - Both creates succeed; the guests have the tags and are pool members. - Setting tags on an existing pool container (PUT /nodes//lxc//config) still works. Not tested: the {} -> '' change in qemu-server, since tag-style user-allow is at its default ('free') here. Tested-by: dreadfulbunny