Custom Roles - Granular Permissions

[nz_monkey]

Hi,

I have found that we are not able to create our own "Roles" in Proxmox. This is a shame, and it restricts us from allocating roles exactly as we would like.

Specifically, we would ideally like to have a role the same as PVEVMUser, but with the addition:

- Can snapshot a VM (Maybe VM.Snapshot and VM.Rollback)
- Can clone but ONLY from a Template (Maybe VM.CloneFromTemplate)

Is it possible Proxmox will allow more granular control of permissions, at least creating new roles with custom permissions ?

 

[dietmar]

I have found that we are not able to create our own "Roles" in Proxmox. This is a shame, and it restricts us from allocating roles exactly as we would like.

see: http://pve.proxmox.com/wiki/User_Management
That contains an example how to add a new role.

also see 'man pveum'

Or what is the problem?

 

[abuhome]

Maybe i think i now what he want.
Some more fine granded acl's. I saw in the git repository some future ideas https://git.proxmox.com/?p=pve-acce...43a66ab128ab180c87a974d510e6009655bcf;hb=HEAD
But these is not implemented yet. If i could code better i would do that. But for now i have to wait.

 

[nz_monkey]

Dietmar,

How do I get a list of all available privileges ? The list on the wiki page you referenced looks to be incomplete.

 

[nz_monkey]

I am mainly looking for the following abilities:

- Allow a user to clone from a template, but not create a template or clone other machines.
- Allow a user to Snapshot a VM, but NOT rollback

 

[dietmar]

- Allow a user to clone from a template, but not create a template or clone other machines.

Not implemented that way, but you can set clone permissions on individual templates (PVETemplateUser role)

- Allow a user to Snapshot a VM, but NOT rollback

That looks strange to me - Anyway, you cannot do that with Proxmox VE.