bug in permissions

[mir]

Hi all,
I have created a group named admins. This group has the following permissions:
Path User/Group/API Token Role Propagate
/ @admins Administrator Yes
I have assigned a user which login through ldap to this group. I have even tried a user@pam but this gives the same result.

For VMs I can change any configuration, setting, option and the same is true for CTs except for changing Unprivileged Container and Features - clicking those two settings does not activate the panel for changing these options. If I am logged in as root@pam changing those options is possible.
Anyone else experiencing these problems?

PVE:
proxmox-ve: 6.3-1 (running kernel: 5.4.78-2-pve)
pve-manager: 6.3-3 (running version: 6.3-3/eee5f901)

 

[fabian]

container features are limited to root@pam for security purposes (some of them potentially allow breaking out of the container). the unprivileged status cannot be changed after the fact in a meaningful way - you need to backup and restore.

 

[mir]

container features are limited to root@pam for security purposes (some of them potentially allow breaking out of the container). the unprivileged status cannot be changed after the fact in a meaningful way - you need to backup and restore.

To me it sounds odd that you can give all permissions to a user/group but then again all != all. Why can root@pam not give any permissions to a user/group? This is contradictory to how permissions work in Linux/Unix.

 

[fabian]

see https://bugzilla.proxmox.com/show_bug.cgi?id=2582