roles: restrict Permissions.Modify to Administrator

[pve-access-control.git] / src / PVE / AccessControl.pm

diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index c1ade4e8fff8cc7155a7fd5cff58bc59ab533405..04dc7d9f8fef0d23c52fab5291d1009f165876d6 100644 (file)
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -1060,7 +1060,6 @@ my $privgroups = {
            'Sys.Incoming', # incoming storage/guest migrations
        ],
        admin => [
-           'Permissions.Modify',
            'Sys.Console',
            'Sys.Syslog',
        ],
@@ -1118,7 +1117,9 @@ my $privgroups = {
     },
 };
 
-my $valid_privs = {};
+my $valid_privs = {
+    'Permissions.Modify' => 1, # not contained in a group
+};
 
 my $special_roles = {
     'NoAccess' => {}, # no privileges