use chattr to set immutable flag on base images

diff --git a/PVE/Storage/Plugin.pm b/PVE/Storage/Plugin.pm
index 0cbf488e5ec3f9e4c7d1d3c0a358d8c8fdaad804..9545626334af05e05df856616cb8b7a5498fcd27 100644 (file)
--- a/PVE/Storage/Plugin.pm
+++ b/PVE/Storage/Plugin.pm
@@ -449,8 +449,14 @@ sub create_base {
     rename($path, $newpath) || 
        die "rename '$path' to '$newpath' failed - $!\n";
 
-    chmod(0444, $newpath);
+    # We try to protect base volume
 
+    chmod(0444, $newpath); # nobody should write anything
+
+    # also try to set immutable flag
+    eval { run_command(['/usr/bin/chattr', '+i', $newpath]); };
+    warn $@ if $@;
+    
     return $newvolname;
 }
 
@@ -575,9 +581,13 @@ sub free_image {
                    "(use by '$tmpvolname')\n";
            }
        }
+ 
+       # try to remove immutable flag
+       eval { run_command(['/usr/bin/chattr', '-i', $path]); };
+       warn $@ if $@;
     }
 
-    unlink $path;
+    unlink($path) || die "unlink '$path' failed - $!\n";
 
     return undef;
 }