Currently, the VM-state-related properties 'runningcpu' and 'runningmachine' are not supposed to end up in the VM configuration of a remote-migratable VM, because a suspended VM is not yet migratable. However, there was a bug and the properties were not removed after cloning from a snapshot, see commit "partially fix #6805: api: clone: properly remove all snapshot-related info". Upon remote migration, the property would be encountered and would be limited to root@pam only.
To aid fixing bug #6805, do proper privilege checking for configuration properties related to the running VM state. Note that the 'vmstate' property is already checked for in the check_vm_modify_config_perm() helper. Note that VM-state-related properties cannot be set via API by a user. Originally-by: Thomas Lamprecht <[email protected]> Signed-off-by: Fiona Ebner <[email protected]> Link: https://lore.proxmox.com/[email protected] (cherry picked from commit 7c05f0be9858543272c1254c83f4dfc266b97fe2) [FE: drop running-nets-host-mtu which does not exist in PVE 8] Signed-off-by: Fiona Ebner <[email protected]> --- src/PVE/API2/Qemu.pm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm index 5af117ba..8b990371 100644 --- a/src/PVE/API2/Qemu.pm +++ b/src/PVE/API2/Qemu.pm @@ -721,6 +721,7 @@ my $check_cpu_model_access = sub { my $cpuoptions = { 'cores' => 1, 'cpu' => 1, + 'runningcpu' => 1, 'cpulimit' => 1, 'cpuunits' => 1, 'numa' => 1, @@ -740,6 +741,7 @@ my $hwtypeoptions = { 'hotplug' => 1, 'kvm' => 1, 'machine' => 1, + 'runningmachine' => 1, 'scsihw' => 1, 'smbios1' => 1, 'tablet' => 1, -- 2.39.5 _______________________________________________ pve-devel mailing list [email protected] https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
