Privileges required to remove an uploaded disk image (content type "import")

[Russell Ault]

I'm not sure if this is a bug or a "works as intended" that I don't quite understand, but I'm confused by the permissions required to remove an uploaded disk image. As near as I can tell (both from the API viewer and from the error messages I'm receiving), removing an uploaded image of content type "import" requires full Datastore.Allocate privileges, while uploading only requires Datastore.AllocateTemplate (which means that users may not be able to remove their own uploaded images). Is this correct?

Thanks!

 

[JohnnieKF]

Datastore.AllocateTemplate covers allocating and uploading templates and ISO images, while deleting volumes falls under Datastore.Allocate (which also covers creating, removing and modifying the storage itself). So it's working as intended rather than a bug [0].

[0] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_privileges

 

[Russell Ault]

Sorry, yes, to be clear, I've read the manual and the API viewer, it's just that the distinction here doesn't make much sense to me. If nothing else there appears to be a significant lack of permissions granularity, since Datastore.Allocate isn't something I'd expect to give to the average user but I would expect them to be able to remove their own images.

Edited to add: put another way, there's already one exception to the Datastore.Allocate requirement, specifically for backup volumes (Datastore.AllocateSpace is sufficient for removing backup volumes if the VM.Backup privilege is assigned on that VM according to the API viewer), and I'm wondering why a similar exception doesn't exist for templates (especially since they already have their own specific permission).