github.com/lxc/incus/v7/cmd/incusd: Project restriction bypass for block.create_options via volume update, copy and move

Summary

The fix for CVE-2026-62867 only rejected block.create_options on the direct custom volume creation path. The same value could still reach a restricted project by setting it on an existing volume, or by copying or moving a volume whose config carries it, as those paths inherit the source volume's config without re-checking the target project's restrictions.

Impact

A user confined to a restricted project who can create or edit custom volumes can set block.create_options on a volume, then trigger a copy or move onto a pool that formats the new volume. The value is appended to the mkfs command line executed as root, giving the same argument injection as the original issue.

Only pools that format on copy, such as non-thin LVM, reach the mkfs call. On other drivers the forbidden option still lands on the volume.

Details

The restriction is now enforced on volume update regardless of project limits, and inside the copy and refresh backends against the effective config after falling back to the source volume's config. This covers cross-project copies, copies that omit the config field, and moves.

Workarounds

Don't grant custom volume creation to restricted projects on pools that format on copy, or set volume.block.create_options on the pool so the pool default applies.