[pve-devel] [RFC v5 qemu-server] VM protection mode

[Alen Grizonic]

v5 changes:

- disk removal prevention -> added unused disk removal prevention
- protection option removal prevention
- changed man page message
---
 PVE/API2/Qemu.pm  | 8 ++++++++
 PVE/QemuServer.pm | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index fabd490..09b1457 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -889,6 +889,9 @@ my $update_vm_api  = sub {
 		$modified->{$opt} = 1;
 		$conf = PVE::QemuServer::load_config($vmid); # update/reload
 		if ($opt =~ m/^unused/) {
+                    if (($conf->{protection}) && ($conf->{protection} == 1)) {
+                        die "can't remove VM $vmid storage - protection mode enabled\n";
+                    }
 		    $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 		    my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 		    if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, $drive, $rpcenv, $authuser)) {
@@ -896,11 +899,16 @@ my $update_vm_api  = sub {
 			PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 		    }
 		} elsif (PVE::QemuServer::valid_drivename($opt)) {
+		    if (($conf->{protection}) && ($conf->{protection} == 1)) {
+			die "can't remove VM $vmid storage - protection mode enabled\n";
+		    }
 		    $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 		    PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
 			if defined($conf->{pending}->{$opt});
 		    PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
 		    PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
+		} elsif (($conf->{protection}) && ($conf->{protection} == 1)) {
+		    die "can't delete VM $vmid protection option - protection mode enabled\n";
 		} else {
 		    PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
 		    PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index be4d3d9..009b447 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -387,7 +387,7 @@ EODESCR
     protection => {
 	optional => 1,
 	type => 'boolean',
-	description => "Sets the protection flag of the VM. This will prevent the remove operation.",
+	description => "Sets the protection flag of the VM. This will prevent the VM or VM's disk remove operation.",
 	default => 0,
     },
 };
-- 
2.1.4