cleanup permission checks

[pve-access-control.git] / PVE / AccessControl.pm

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index 0dce3e62a0f3ad0760f8b2bde06af6ff23c385e0..ddad2c7743ac037040307522b77249ebf14f34cf 100644 (file)
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -557,7 +557,7 @@ my $privgroups = {
            'VM.PowerMgmt',
        ],
        audit => [ 
-           'VM.Audit' 
+           'VM.Audit',
        ],
     },
     Sys => {
@@ -588,10 +588,13 @@ my $privgroups = {
        ],
     },
     User => {
-       root => [],
+       root => [
+           'Realm.Allocate',
+       ],
        admin => [
            'User.Modify',
-           'User.Allocate',
+           'Group.Allocate', # edit/change group settings
+           'Realm.AllocateUser', 
        ],
        user => [],
        audit => [],