Permissions for User to hibernate VM and change hardware

[Eumel]

What permissions do users need to be able to hibernate a VM?
I gave him PVEAdmin but he still gets a" no permission for Datastore.AllocateSpace" error.

The same question goes for changing hardware, two users share a GPU on passthrough. Currently if they want to swap it has to go through me to remove and add the pci device since they dont get permission.

 

[shrdlicka]

Hi,
besides the rights to the VM they also need the right to allocate storage in the storage selected within the options of the VM under Options/VM State Storage. The default location is the "local" storage. I didn't check if these are the least permissions possible, but setting these two I could send the VM into hibernation with my "fun" user.

 

[Eumel]

Hi,
besides the rights to the VM they also need the right to allocate storage in the storage selected within the options of the VM under Options/VM State Storage. The default location is the "local" storage. I didn't check if these are the least permissions possible, but setting these two I could send the VM into hibernation with my "fun" user.

View attachment 37899

Perfect, that did the trick.
I guess we have a different version installed, for me it was under the storage for my node (for future reference only).

Any idea on the adding and removing PCI devices front?

 

[shrdlicka]

Can you post the error message the users are getting when they try to remove PCI devices?

 

[fabian]

PCI passthrough requires root privileges (as it can easily cause problems for the whole system), that is currently not assignable to other users. there is a patch series for allowing that being worked on - but obviously this is not something you want to allow for random users, but rather for admin accounts that would otherwise also have root-level access (e.g. via a personalized login that can do `sudo`).

 

[Eumel]

Can you post the error message the users are getting when they try to remove PCI devices?

Theres not really an error, adding and removing pci devices is greyed out for them

PCI passthrough requires root privileges (as it can easily cause problems for the whole system), that is currently not assignable to other users. there is a patch series for allowing that being worked on - but obviously this is not something you want to allow for random users, but rather for admin accounts that would otherwise also have root-level access (e.g. via a personalized login that can do `sudo`).

The passthrough is active either way afaik, I only want to map it to different VMs in the webview.
These are also trusted users, if this wont work theyll get the root login. The seperation now is mainly for good form.