config: sync ACL checks with qemu-server

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index bc81ba74382d4343ea7676cd54fe4ea5a5eacb0c..139f901ee97fdc17c3eb6832989ebede26c18e3a 100644 (file)
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -55,6 +55,8 @@ my $nodename = PVE::INotify::nodename();
 
 my $cpuinfo= PVE::ProcFSTools::read_cpuinfo();
 
+our $NEW_DISK_RE = qr/^([^:\s]+):(\d+(\.\d+)?)$/;
+
 sub config_list {
     my $vmlist = PVE::Cluster::get_vmlist();
     my $res = {};
@@ -1243,6 +1245,7 @@ sub check_ct_modify_config_perm {
     my ($rpcenv, $authuser, $vmid, $pool, $newconf, $delete) = @_;
 
     return 1 if $authuser eq 'root@pam';
+    my $storage_cfg = PVE::Storage::config();
 
     my $check = sub {
        my ($opt, $delete) = @_;
@@ -1254,6 +1257,13 @@ sub check_ct_modify_config_perm {
            my $data = PVE::LXC::Config->parse_volume($opt, $newconf->{$opt});
            raise_perm_exc("mount point type $data->{type} is only allowed for root\@pam")
                if $data->{type} ne 'volume';
+           my $volid = $data->{volume};
+           if ($volid =~ $NEW_DISK_RE) {
+               my $sid = $1;
+               $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
+           } else {
+               PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $volid);
+           }
        } elsif ($opt eq 'memory' || $opt eq 'swap') {
            $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
        } elsif ($opt =~ m/^net\d+$/ || $opt eq 'nameserver' ||
@@ -1935,7 +1945,6 @@ sub alloc_disk {
     return ($volid, $needs_chown);
 }
 
-our $NEW_DISK_RE = qr/^([^:\s]+):(\d+(\.\d+)?)$/;
 sub create_disks {
     my ($storecfg, $vmid, $settings, $conf, $pending) = @_;