[pve-devel] [PATCH qemu-server 2/3] partially fix #6805: api: modify vm config: privilege checks for VM-state-related properties

[Fiona Ebner]

Currently, the VM-state-related properties 'runningcpu' and
'runningmachine' are not supposed to end up in the VM configuration of
a remote-migratable VM, because a suspended VM is not yet migratable.
However, there was a bug and the properties were not removed after
cloning from a snapshot, see commit "partially fix #6805: api: clone:
properly remove all snapshot-related info". Upon remote migration, the
property would be encountered and would be limited to root at pam only.

To aid fixing bug #6805, do proper privilege checking for
configuration properties related to the running VM state.

Note that the 'vmstate' property is already checked for in the
check_vm_modify_config_perm() helper. Note that VM-state-related
properties cannot be set via API by a user.

Originally-by: Thomas Lamprecht <t.lamprecht at proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
Link: https://lore.proxmox.com/20250917163038.488710-3-f.ebner@proxmox.com
(cherry picked from commit 7c05f0be9858543272c1254c83f4dfc266b97fe2)
[FE: drop running-nets-host-mtu which does not exist in PVE 8]
Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---
 src/PVE/API2/Qemu.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 5af117ba..8b990371 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -721,6 +721,7 @@ my $check_cpu_model_access = sub {
 my $cpuoptions = {
     'cores' => 1,
     'cpu' => 1,
+    'runningcpu' => 1,
     'cpulimit' => 1,
     'cpuunits' => 1,
     'numa' => 1,
@@ -740,6 +741,7 @@ my $hwtypeoptions = {
     'hotplug' => 1,
     'kvm' => 1,
     'machine' => 1,
+    'runningmachine' => 1,
     'scsihw' => 1,
     'smbios1' => 1,
     'tablet' => 1,
-- 
2.39.5