[SOLVED] Administrator User cannot create VM - Permission check failed (403)

R

Razva

Renowned Member
Dec 3, 2013
252
10
83
Romania
cncted.com
Hello,

I want to create a new user that is able to create VMs by itself, but without seeing other VMs on the node. I've been playing with permissions in the last hours but unfortunately I can't find out what's the issue.

As a last solution, for testing purposes, I've added Administrator privileges to the user. Even so, the user gets this error, every time he tries to click Finish.

Code: 
Permission check failed (403)

At this point the user has:
  • Administrator @ Pool -> Permissions
  • Administrator @ local-lvm
  • Administrator @ storage (CIFS mount for ISO and backups)
  • The Pool has local-lvm and storage @ Members
2020-01-24_19-52-07.png

Any hints why this is not working? Any way to see the logs?

Thank you!
 
Hi,
as @chotaire already said, you need to add two more permissions for your user. One with path /vms and role PVEVMAdmin and one with path /nodes and role PVEVMAdmin should be sufficient.
 
Fabian_E said:
Hi,
as @chotaire already said, you need to add two more permissions for your user. One with path /vms and role PVEVMAdmin and one with path /nodes and role PVEVMAdmin should be sufficient.
Click to expand...
Can you please let me know how should I do that? I can't find any way of adding custom paths to the Pool. Thank you very much!
 
If they get the role PVEVMAdmin they can see all existing and future VMs if you give them access to /vms.
Is that what you intend? Also please read about the role PVEVMUser.
 
chotaire said:
If they get the role PVEVMAdmin they can see all existing and future VMs if you give them access to /vms.
Is that what you intend?
Click to expand...
Nope, my target is to allow a specific user/group to create VMs that only he can manage, without seeing VMs created by other users/groups. Any way to achieve this?
 
If you've already played with Privileges, you could just test it with a user that you have created? Then report back if it works or if something is not working as intended. It's always a good idea to try abusing your own server as ordinary user, so you know what you're doing instead of relying on an advice by a random forum user ;) Try configuring GROUP permissions the way you want them, and then add two users to this group and see if they can fiddle with each others VMs (or even see them).
 
chotaire said:
If you've already played with Privileges, you could just test it with a user that you have created? Then report back if it works or if something is not working as intended. It's always a good idea to try abusing your own server as ordinary user, so you know what you're doing instead of relying on an advice by a random forum user ;) Try configuring GROUP permissions the way you want them, and then add two users to this group and see if they can fiddle with each others VMs (or even see them).
Click to expand...
I'm doing exactly that. :P I'm currently creating a custom Role and play with it. I'll get back in a couple of minutes. Thanks again!
 
Hint: I think this kind of configuration needs a "pool" to be created under Permissions. One pool for each user (or one for multiple users if they want to administrate each others VMs). Someone please step in if this is not required, I am not going to test this now.
 
chotaire said:
If you've already played with Privileges, you could just test it with a user that you have created? Then report back if it works or if something is not working as intended. It's always a good idea to try abusing your own server as ordinary user, so you know what you're doing instead of relying on an advice by a random forum user ;) Try configuring GROUP permissions the way you want them, and then add two users to this group and see if they can fiddle with each others VMs (or even see them).
Click to expand...
Ooook, so it seems that I'm stuck at /vms. As long as I'm assigning VM.Audit permission to the Group, all the VMs on the node appear on the user's WebUI. Without VM.Audit permission the user can't see its own VMs. Sooo...is there any way to work around this, without manually specifying each VM?
 
Then you have given global permissions. You need to give specific permissions to the specific pool for a group or a user. There is even an example in documentation how to make a group become PVEAdmin of a pool.

pveum aclmod /pool/dev-pool/ -group developers -role PVEAdmin

It can't be that hard ;)
 
Last edited:
  • Like
Reactions: Razva
And don't forget: A pool is simply a set of virtual machines and data stores. You can create pools on the GUI. After that you can add resources to the pool (VMs, Storage). And then you give a user or group access to that pool with specific roles. Which means that a user or group can have access to multiple pools with different roles.
 
  • Like
Reactions: Razva
You must log in or register to reply here.
Top Bottom