[PATCH container] fix: #7148: check CT protection before reassigning volume

[PATCH container] fix: #7148: check CT protection before reassigning volume

[Jakob Klocker]

When reassigning a volume, check the destination config before
removing the volume from the source config.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7148
Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
---
 src/PVE/API2/LXC.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index 88067dd..af01de0 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -2791,6 +2791,8 @@ __PACKAGE__->register_method({
                     if !PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
             }
 
+            PVE::LXC::Config->check_protection($target_conf, "can't move volume '$target_mpkey' to CT $target_vmid");
+
             return ($source_conf, $target_conf, $drive);
         };
 
-- 
2.47.3

Re: [PATCH container] fix: #7148: check CT protection before reassigning volume

[Lukas Sichert]

I was able to reproduce the Problem, the Patch worked for me.

One thing I found, which is only indirectly related:
One can't move storage to a protected container, but one can move
storage from a protected container to an unprotected container, which to
my intuition seems wrong.
Is this expected behaviour?

Tested-by: Lukas Sichert <l.sichert@proxmox.com>

On 2026-06-01 13:52, Jakob Klocker <j.klocker@proxmox.com> wrote:

> When reassigning a volume, check the destination config before
> removing the volume from the source config.
>
> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7148
> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
> ---
>  src/PVE/API2/LXC.pm | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
> index 88067dd..af01de0 100644
> --- a/src/PVE/API2/LXC.pm
> +++ b/src/PVE/API2/LXC.pm
> @@ -2791,6 +2791,8 @@ __PACKAGE__->register_method({
>                      if !PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
>              }
>  
> +            PVE::LXC::Config->check_protection($target_conf, "can't move volume '$target_mpkey' to CT $target_vmid");
> +
>              return ($source_conf, $target_conf, $drive);
>          };
>  
> -- 
> 2.47.3

Re: [PATCH container] fix: #7148: check CT protection before reassigning volume

[Fiona Ebner]

Am 05.06.26 um 4:26 PM schrieb Lukas Sichert:
> I was able to reproduce the Problem, the Patch worked for me.
> 
> One thing I found, which is only indirectly related:
> One can't move storage to a protected container, but one can move
> storage from a protected container to an unprotected container, which to
> my intuition seems wrong.
> Is this expected behaviour?
The documentation agrees that this is wrong:

protection: <boolean> (default = 0)
Sets the protection flag of the container. This will prevent the CT or
CT’s disk remove/update operation.

And looking into the code, all direct config changes to
mpX/unusedX/rootfs are prohibited. So reassign should be prohibited in
both directions.

For VMs, the flag is documented as:

protection: <boolean> (default = 0)
Sets the protection flag of the VM. This will disable the remove VM and
remove disk operations.

Adding disks to a protected VM works, but removing a disk does not. So
reassign away from a protected VM should also be prohibited. It
currently isn't.

If we want to further restrict adding disks to a protected VM, that
should be done for the next major release, but I'm not fully sure we
should go for that.

@Jakob: could you send follow-ups for those issues?

> 
> Tested-by: Lukas Sichert <l.sichert@proxmox.com>
> 
> On 2026-06-01 13:52, Jakob Klocker <j.klocker@proxmox.com> wrote:
> 
>> When reassigning a volume, check the destination config before
>> removing the volume from the source config.
>>
>> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7148
>> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
>> ---
>>  src/PVE/API2/LXC.pm | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
>> index 88067dd..af01de0 100644
>> --- a/src/PVE/API2/LXC.pm
>> +++ b/src/PVE/API2/LXC.pm
>> @@ -2791,6 +2791,8 @@ __PACKAGE__->register_method({
>>                      if !PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
>>              }
>>  
>> +            PVE::LXC::Config->check_protection($target_conf, "can't move volume '$target_mpkey' to CT $target_vmid");
>> +
>>              return ($source_conf, $target_conf, $drive);
>>          };
>>  
>> -- 
>> 2.47.3
> 
> 
> 
> 
> 

Re: [PATCH container] fix: #7148: check CT protection before reassigning volume

[Jakob Klocker]

On Wed Aug 26, 2026 at 4:22 PM CEST, Fiona Ebner wrote:
> Am 05.06.26 um 4:26 PM schrieb Lukas Sichert:
>> I was able to reproduce the Problem, the Patch worked for me.
>> 
>> One thing I found, which is only indirectly related:
>> One can't move storage to a protected container, but one can move
>> storage from a protected container to an unprotected container, which to
>> my intuition seems wrong.
>> Is this expected behaviour?
> The documentation agrees that this is wrong:
>
> protection: <boolean> (default = 0)
> Sets the protection flag of the container. This will prevent the CT or
> CT’s disk remove/update operation.
>
> And looking into the code, all direct config changes to
> mpX/unusedX/rootfs are prohibited. So reassign should be prohibited in
> both directions.
>
> For VMs, the flag is documented as:
>
> protection: <boolean> (default = 0)
> Sets the protection flag of the VM. This will disable the remove VM and
> remove disk operations.
>
> Adding disks to a protected VM works, but removing a disk does not. So
> reassign away from a protected VM should also be prohibited. It
> currently isn't.
>
> If we want to further restrict adding disks to a protected VM, that
> should be done for the next major release, but I'm not fully sure we
> should go for that.
>
> @Jakob: could you send follow-ups for those issues?

Apologies, I missed Lukas' reply. I'll look into this and send 
follow-ups.

>> 
>> Tested-by: Lukas Sichert <l.sichert@proxmox.com>
>> 
>> On 2026-06-01 13:52, Jakob Klocker <j.klocker@proxmox.com> wrote:
>> 
>>> When reassigning a volume, check the destination config before
>>> removing the volume from the source config.
>>>
>>> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7148
>>> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
>>> ---
>>>  src/PVE/API2/LXC.pm | 2 ++
>>>  1 file changed, 2 insertions(+)
>>>
>>> diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
>>> index 88067dd..af01de0 100644
>>> --- a/src/PVE/API2/LXC.pm
>>> +++ b/src/PVE/API2/LXC.pm
>>> @@ -2791,6 +2791,8 @@ __PACKAGE__->register_method({
>>>                      if !PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
>>>              }
>>>  
>>> +            PVE::LXC::Config->check_protection($target_conf, "can't move volume '$target_mpkey' to CT $target_vmid");
>>> +
>>>              return ($source_conf, $target_conf, $drive);
>>>          };
>>>  
>>> -- 
>>> 2.47.3
>> 
>> 
>> 
>> 
>> 

applied: [PATCH container] fix: #7148: check CT protection before reassigning volume

[Fiona Ebner]

On Mon, 01 Jun 2026 13:52:40 +0200, Jakob Klocker wrote:
> When reassigning a volume, check the destination config before
> removing the volume from the source config.

Applied, thanks! Ran make tidy, extended the commit message a bit and
avoided the misleading "volume '$target_mpkey'" in the error message,
which wrongly uses the target mp id, while making it fully explicit
that the assignment to the target is what fails because of the
protection mode.

[1/1] fix: #7148: check CT protection before reassigning volume
      commit: c05243e426f69abc06a5768cafdbca3934f6caa4