[pve-devel] [PATCH manager 7/9] pve8to9: check for to-be-dropped VM.Monitor privilege in custom roles

[Fiona Ebner]

Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---
 PVE/CLI/pve8to9.pm | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/PVE/CLI/pve8to9.pm b/PVE/CLI/pve8to9.pm
index 0c7cb97f..b0e09c6d 100644
--- a/PVE/CLI/pve8to9.pm
+++ b/PVE/CLI/pve8to9.pm
@@ -768,9 +768,21 @@ sub check_custom_pool_roles {
     for my $role (sort keys %{$roles}) {
         next if PVE::AccessControl::role_is_special($role);
         $custom_roles++;
+
+        $need_handling++ if $roles->{$role}->{'VM.Monitor'};
     }
     if ($need_handling > 0) {
-        log_fail("$need_handling custom role(s) need handling");
+        log_notice(
+            "Proxmox VE 9 replaced the ambiguously named 'VM.Monitor' privilege with 'Sys.Audit'"
+                . " for QEMU HMP monitor access and new dedicated 'VM.GuestAgent.*' privileges"
+                . " for access to a VM's guest agent. The guest agent sub-privileges are 'Audit'"
+                . " for all informational commands, 'FileRead' and 'FileWrite' for file-read and"
+                . " file-write, 'FileSystemMgmt' for filesystem freeze, thaw and trim, and"
+                . " 'Unrestricted' for everything, including command execution. Operations that"
+                . " affect the VM runstate require 'VM.PowerMgmt' or 'VM.GuestAgent.Unrestricted'");
+        log_fail(
+            "$need_handling custom role(s) use the to-be-dropped 'VM.Monitor' privilege and need"
+                . " to be adapted after the upgrade");
     } elsif ($custom_roles > 0) {
         log_pass("none of the $custom_roles custom roles need handling");
     } else {
-- 
2.47.2