On Fri, Jul 24, 2009 at 12:19:22AM -0400, Miloslav Trmac wrote: In general all libvirt clients have the same privileges, the only restriction being local read-only clients. Basically if a client authenticates read-write then they can access / modify all objects managed on that host. In the future we will introduce fine grained access control down to a level of (user, object, operation). We have to allow returning the secrets, because clients need to be able to round-trip the XML without loosing data, eg xml = virDomainGetXMLDesc(dom, VIR_DOMAIN_XML_INACTIVE | VIR_DOMAIN_XML_SECURE) ...modify xml... virDomainDefineXML(conn, xml) must not loose any data, including the secrets. Allowing other clients access to the secrets is fine - all authenticated clients are considered equal. We shouldn't try to define restrictions on this specifically for disk encryption, as fine grained per-client access control will be introduced across the whole of libvirt at a later date. There is a small race wrt to pool refresh, however, in the scenario of not using a keystore, this is an acceptable limitation IMHO. If using a keystore, then libvirt can associate a key ID with a volume and maintain that mapping long term, and reliably pass the actual secrets about internally. Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|