Group permision -> create a full powered admin group

[R0bin]

Hi !

I'm using proxmox 6.1-3 in clustered mode, and when I tried to create a mariadb/debian 10 LXC container, I was stucked with apparmor ( see detail and solution from someone else : https://forum.proxmox.com/threads/proxmox-debian-10-buster-template-and-mariadb.56652/)

So I need to enable "nested" option on each mariadb/debian10 CT. OK, I tried that and it works like a charm.

BUT :

I only can change this settings from PVE webinterface with root user.With my LDAP users, even if my users are un a group with permission path "/" propageted, I can't click "Edit" on the option tab.

Can you explain me why, I how can I delegate rights to enable nested mode to a group of users on all my nodes, and for all of my existing and future containers please ?

I attach screenshots of my group permission, I the grey button "Edit" with a user in the "Administrator" group

Thank you for your help !

 

[fabian]

features are only settable by the root user for security reasons

 

[R0bin]

Is there no way to delegate features?

To give you context:

In our company, we use several hundred containers, and we are 4 administrators who have to create containers several times a week. I understand that this is security, but asking everyone to use the root account is even worse as security issues.

 

[fabian]

not currently. I'd like to add a special role/privilege between Administrator and root@pam, that could basically do everything that root@pam does that is feasible over the API (there are some root@pam features like piping in a template/backup archive when creating/restoring a container, which is obviously not possible via the API ).

filed https://bugzilla.proxmox.com/show_bug.cgi?id=2582 for easier tracking, since it's been on my mind for quite a while. might help to collect some feedback from other devs there, implementation should be fairly straight-forward.

 

[R0bin]

Thank you !
If you need testing, I'll help you with joy.
keep in touch.

 

[fabian]

please subscribe to the bug - I'll update it once patches and/or packages are available for testing.