Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

>> possible ambiguities (since it is legal [although stupid] to have a user >> name consisting of all digits and worse having the name differ from the >> underlying uid),

> The other option (that I prefer more) would be to document this > behavior and leave it as proposed in this patch. Or maybe just > reverse the order of resolving so that the numerical parsing is done > before name parsing. > > If we warn the user, that specifying numerical values will result > into using them as UID and GID and strings being translated we > filter out the ambiguity by our design. > > I don't think it's worth spending this effort on such a weird corner case. I agree with Peter here. These ambiguities will be very rare and a well-documented behavior should be enough for this scenario. However reversing the order still can lead to ambiguities, because it's never possible to be sure if a sequence of digits is a username or not. But again, we just need to make this point clear in docs.

>> except that what happens if I want to mix number and name between uid >> and gid? >> > > Mixing them will work in my approach presented here.