[pve-devel] [PATCH qemu-server 2/3] partially fix #6805: api: modify vm config: privilege checks for VM-state-related properties
Fiona Ebner
f.ebner at proxmox.com
Thu Sep 18 11:38:41 CEST 2025
Currently, the VM-state-related properties 'runningcpu' and
'runningmachine' are not supposed to end up in the VM configuration of
a remote-migratable VM, because a suspended VM is not yet migratable.
However, there was a bug and the properties were not removed after
cloning from a snapshot, see commit "partially fix #6805: api: clone:
properly remove all snapshot-related info". Upon remote migration, the
property would be encountered and would be limited to root at pam only.
To aid fixing bug #6805, do proper privilege checking for
configuration properties related to the running VM state.
Note that the 'vmstate' property is already checked for in the
check_vm_modify_config_perm() helper. Note that VM-state-related
properties cannot be set via API by a user.
Originally-by: Thomas Lamprecht <t.lamprecht at proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
Link: https://lore.proxmox.com/20250917163038.488710-3-f.ebner@proxmox.com
(cherry picked from commit 7c05f0be9858543272c1254c83f4dfc266b97fe2)
[FE: drop running-nets-host-mtu which does not exist in PVE 8]
Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---
src/PVE/API2/Qemu.pm | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 5af117ba..8b990371 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -721,6 +721,7 @@ my $check_cpu_model_access = sub {
my $cpuoptions = {
'cores' => 1,
'cpu' => 1,
+ 'runningcpu' => 1,
'cpulimit' => 1,
'cpuunits' => 1,
'numa' => 1,
@@ -740,6 +741,7 @@ my $hwtypeoptions = {
'hotplug' => 1,
'kvm' => 1,
'machine' => 1,
+ 'runningmachine' => 1,
'scsihw' => 1,
'smbios1' => 1,
'tablet' => 1,
--
2.39.5
More information about the pve-devel
mailing list