only add Permissions.Modify to SysAdmin role

[pve-access-control.git] / PVE / AccessControl.pm

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index ee731d8aa457ddd4b564127694df1e78011590ad..331823e3b5130aa77b01d4187fad8e920070d441 100644 (file)
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -540,7 +540,6 @@ my $privgroups = {
            'VM.Modify', 
            'VM.Allocate', 
            'VM.Migrate',
-           'Permissions.Modify',
        ],
        user => [
            'VM.Console', 
@@ -556,6 +555,7 @@ my $privgroups = {
            'Sys.Modify', # edit/change node settings
        ],
        admin => [
+           'Permissions.Modify',
            'Sys.Console',    
            'Sys.Syslog',
        ],
@@ -565,9 +565,7 @@ my $privgroups = {
        ],
     },
     Datastore => {
-       root => [
-           'Permissions.Modify',
-       ],
+       root => [],
        admin => [
            'Datastore.Allocate',
        ],