only add Permissions.Modify to SysAdmin role

[pve-access-control.git] / PVE / AccessControl.pm

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index 6afe65cdae7c542e659b07a7372f28030ea38bc5..331823e3b5130aa77b01d4187fad8e920070d441 100644 (file)
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -540,7 +540,6 @@ my $privgroups = {
            'VM.Modify', 
            'VM.Allocate', 
            'VM.Migrate',
-           'Permissions.Modify',
        ],
        user => [
            'VM.Console', 
@@ -556,6 +555,7 @@ my $privgroups = {
            'Sys.Modify', # edit/change node settings
        ],
        admin => [
+           'Permissions.Modify',
            'Sys.Console',    
            'Sys.Syslog',
        ],
@@ -565,11 +565,10 @@ my $privgroups = {
        ],
     },
     Datastore => {
-       root => [
+       root => [],
+       admin => [
            'Datastore.Allocate',
-           'Permissions.Modify',
        ],
-       admin => [],
        user => [
            'Datastore.AllocateSpace',
        ],
@@ -578,14 +577,11 @@ my $privgroups = {
        ],
     },
     User => {
-       root => [
-
-           ],
+       root => [],
        admin => [
            'User.Modify',
-           'User.Add',
-           'User.Delete',
-           ],
+           'User.Allocate',
+       ],
        user => [],
        audit => [],
     },