v3 changes: - disk removal prevention
- preventing restore over existing CT - changed error and man messages --- src/PVE/API2/LXC.pm | 9 ++++++++- src/PVE/API2/LXC/Config.pm | 10 +++++++++- src/PVE/LXC.pm | 10 ++++++++++ 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm index d5acace..80312b2 100644 --- a/src/PVE/API2/LXC.pm +++ b/src/PVE/API2/LXC.pm @@ -235,9 +235,13 @@ __PACKAGE__->register_method({ my $restore = extract_param($param, 'restore'); + my $conf = PVE::LXC::load_config($vmid); + if ($restore) { # fixme: limit allowed parameters + die "unable to overwrite existing CT $vmid - protection mode enabled\n" + if (($same_container_exists) &&($conf->{protection} == 1)); } my $force = extract_param($param, 'force'); @@ -297,7 +301,7 @@ __PACKAGE__->register_method({ $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $ostemplate); } - my $conf = {}; + $conf = {}; my $no_disk_param = {}; foreach my $opt (keys %$param) { @@ -535,6 +539,9 @@ __PACKAGE__->register_method({ my $storage_cfg = cfs_read_file("storage.cfg"); + die "can't remove CT $vmid - protection mode enabled\n" + if ($conf->{protection} == 1); + die "unable to remove CT $vmid - used in HA resources\n" if PVE::HA::Config::vm_is_ha_managed($vmid); diff --git a/src/PVE/API2/LXC/Config.pm b/src/PVE/API2/LXC/Config.pm index 95eafaa..b601a66 100644 --- a/src/PVE/API2/LXC/Config.pm +++ b/src/PVE/API2/LXC/Config.pm @@ -115,6 +115,8 @@ __PACKAGE__->register_method({ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]); + my $conf = PVE::LXC::load_config($vmid); + foreach my $opt (@delete) { raise_param_exc({ delete => "you can't use '-$opt' and " . "-delete $opt' at the same time" }) @@ -122,6 +124,13 @@ __PACKAGE__->register_method({ if (!PVE::LXC::option_exists($opt)) { raise_param_exc({ delete => "unknown option '$opt'" }); + } elsif ($opt eq 'protection') { + die "can't remove CT $vmid protection option - protection mode enabled\n" . + "use \"pct set {vmid} -protection 0\" command instead\n" + if ($conf->{protection} == 1); + } elsif ($opt eq 'rootfs' || $opt =~ m/^mp(\d+)$/) { + die "can't remove CT $vmid storage - protection mode enabled\n" + if ($conf->{protection} == 1); } } @@ -131,7 +140,6 @@ __PACKAGE__->register_method({ my $code = sub { - my $conf = PVE::LXC::load_config($vmid); PVE::LXC::check_lock($conf); PVE::Tools::assert_if_modified($digest, $conf->{digest}); diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm index e296047..ef61bec 100644 --- a/src/PVE/LXC.pm +++ b/src/PVE/LXC.pm @@ -175,6 +175,12 @@ my $confdesc = { enum => ['shell', 'console', 'tty'], default => 'tty', }, + protection => { + optional => 1, + type => 'boolean', + description => "Sets the protection flag of the container. This will prevent the container or container's disk remove operation.", + default => 0, + }, }; my $valid_lxc_conf_keys = { @@ -1097,6 +1103,8 @@ sub update_pct_config { next if !$running; my $netid = $1; PVE::Network::veth_delete("veth${vmid}i$netid"); + } elsif ($opt eq 'protection') { + delete $conf->{$opt}; } elsif ($opt eq 'rootfs' || $opt =~ m/^mp(\d+)$/) { die "implement me" } else { @@ -1165,6 +1173,8 @@ sub update_pct_config { } else { update_net($vmid, $conf, $opt, $net, $netid, $rootdir); } + } elsif ($opt eq 'protection') { + $conf->{$opt} = $value ? 1 : 0; } elsif ($opt eq 'rootfs' || $opt =~ m/^mp(\d+)$/) { die "implement me: $opt"; } else { -- 2.1.4 _______________________________________________ pve-devel mailing list pve-devel@pve.proxmox.com http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel