Re: [PATCH qemu-server 2/2] api: refuse moving disks if source VM is protected

["Michael Köppl" <m.koeppl@proxmox.com>]

nit: the commit subject reads too broad. This commit only affects moving
disks to another VM. Moving disks to another storage is still possible
even with the --delete flag which removes the old disk. Mostly noticed
this because I initially thought this patch also covers the case where a
disk is moved to another storage.

I'm not entirely sure how to best handle this, though. On the one hand,
moving to another storage with --delete doesn't really remove anything
from the VM in that since, since it attaches the new disk on the new
storage in its place. On the other hand, the behavior then differs
between CTs and VMs. I think the basis for this in the docs saying that
the protection option on CTs prevents "disk remove/update operation"
(which moving a volume to another storage is), whereas the VM docs only
say "This will disable the remove VM and remove disk operations". Still,
wanted to bring it up to clarify the scope of this. Maybe @Fiona can
share her thoughts on this. I suppose if the behavior here should match
the CT behavior, the docs would of course also have to be updated.

On Mon Sep 21, 2026 at 5:35 PM CEST, Jakob Klocker wrote:
> Moving a disk removes it from the source VM, which, according to the
> documentation, the protection flag prevents.
> Refuse the move when the source is protected.
>
> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
> ---
>  src/PVE/API2/Qemu.pm | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
> index 922c6599..3cf3517b 100644
> --- a/src/PVE/API2/Qemu.pm
> +++ b/src/PVE/API2/Qemu.pm
> @@ -5024,6 +5024,11 @@ __PACKAGE__->register_method({
>              my $target_conf = PVE::QemuConfig->load_config($target_vmid);
>              PVE::QemuConfig->check_lock($target_conf);
>
> +            PVE::QemuConfig->check_protection(
> +                $source_conf,
> +                "Can't move disks from protected VMs\n",
> +            );
> +
>              die "Can't move disks from or to template VMs\n"
>                  if ($source_conf->{template} || $target_conf->{template});
>