Re: [libvirt] ACLs for libvirt

On Thu, Nov 24, 2011 at 09:45:44AM +0000, Daniel P. Berrange wrote: > > In addition "API" is really the wrong level of granularity for expressing > > the checks. Several separate APIs will need to be covered under the same > > check, while at the same time, one API might require multiple checks. > > For clarity here are some examples of why you can't do checks at the API > level, and instead must do it inside each driver > > * The virDomainDefineXML API - you need todo two separate checks, one > if the config does not already exist (eg defining a new guest), and > another if the config does exist (updating an existing guest). Okay > * virDomainListDomains API - you need to filter the returned list of > IDs to only those the user is allowed to view. You can't do the filtering > if you only have the IDs, so it needs to be done inthe driver Here I'm far less convinced. To me the role system influence the API in saying if you can run the API or not. In that case you want to change the API output. I'm not sure it's a good idea. If I take the unix analogy, it's okay to forbid listing directories (even if some files may be accessible to the user), but changing the directory listing based on whom does the operation makes an awful lot of things more complex. I'm not sure we want to do this !

> * virDomainAttachDevice API - need to todo different checks for the > different types of device being attached & potentially multiple > checks if the attached device references other host resources. > eg a PCI device attach with managed=yes, must check that the user > is allowed to attach a device, and also check that the user is > allowed to detach & reset host PCI devices. If we try to go too fine grained we are likely to make it too hard to use, I see a risk here.