normal tags require 'VM.Config.Options' on the CT, admin tags require
'Sys.Modify' on '/'
a user can set/delete/reorder tags, as long as no admin tags get
added/removed
Signed-off-by: Dominik Csapak <d.csa...@proxmox.com>
---
src/PVE/LXC.pm | 31 +++++++++++++++++++++++++++++++
src/PVE/LXC/Config.pm | 3 ++-
2 files changed, 33 insertions(+), 1 deletion(-)
diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index fe63087..ce2f8ff 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1333,6 +1333,37 @@ sub check_ct_modify_config_perm {
} elsif ($opt eq 'hookscript') {
# For now this is restricted to root@pam
raise_perm_exc("changing the hookscript is only allowed for
root\@pam");
+ } elsif ($opt eq 'tags') {
+ my $old_tags = {};
+ my $new_tags = {};
+ my $check_admin = 0;
+ my $check_user = 0;
+
+ map { $old_tags->{$_} = 1 }
PVE::Tools::split_list($oldconf->{$opt});
+ map { $new_tags->{$_} = 1 }
PVE::Tools::split_list($newconf->{$opt});
+
+ my $check_tags = sub {
+ my ($a, $b) = @_;
+ foreach my $tag (keys %$a) {
+ next if $b->{$tag};
+ if (PVE::JSONSchema::is_admin_pve_tag($tag)) {
+ $check_admin = 1;
+ } else {
+ $check_user = 1;
+ }
+ }
+ };
+
+ $check_tags->($old_tags, $new_tags);
+ $check_tags->($new_tags, $old_tags);
+
+ if ($check_admin) {
+ $rpcenv->check($authuser, "/", ['Sys.Modify']);
+ }
+
+ if ($check_user) {
+ $rpcenv->check_vm_perm($authuser, $vmid, $pool,
['VM.Config.Options']);
+ }
} else {
$rpcenv->check_vm_perm($authuser, $vmid, $pool,
['VM.Config.Options']);
}
diff --git a/src/PVE/LXC/Config.pm b/src/PVE/LXC/Config.pm
index b4b0261..2362d74 100644
--- a/src/PVE/LXC/Config.pm
+++ b/src/PVE/LXC/Config.pm
@@ -597,7 +597,8 @@ my $confdesc = {
},
tags => {
type => 'string', format => 'pve-tag-list',
- description => 'Tags of the Container. This is only meta information.',
+ description => 'Tags of the Container. This is only meta information.
Prefixing a tag with'.
+ "'+' marks it as an admin tag and can only be set with 'Sys.Modify'
on '/'.",
optional => 1,
},
debug => {
--
2.30.2
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
