[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v3 09/11] authz: add QAuthZListFile object type
From: |
Dr. David Alan Gilbert |
Subject: |
Re: [Qemu-devel] [PATCH v3 09/11] authz: add QAuthZListFile object type for a file access control list |
Date: |
Wed, 20 Jun 2018 12:29:38 +0100 |
User-agent: |
Mutt/1.10.0 (2018-05-17) |
* Daniel P. Berrangé (address@hidden) wrote:
> On Wed, Jun 20, 2018 at 11:58:01AM +0100, Dr. David Alan Gilbert wrote:
> > * Daniel P. Berrangé (address@hidden) wrote:
> > > Add a QAuthZListFile object type that implements the QAuthZ interface.
> > > This
> > > built-in implementation is a proxy around the QAtuhZList object type,
> > > initializing it from an external file, and optionally, automatically
> > > reloading it whenever it changes.
> > >
> > > To create an instance of this object via the QMP monitor, the syntax
> > > used would be:
> > >
> > > {
> > > "execute": "object-add",
> > > "arguments": {
> > > "qom-type": "authz-list-file",
> > > "id": "authz0",
> > > "parameters": {
> > > "filename": "/etc/qemu/vnc.acl",
> > > "refresh": "yes"
> > > }
> > > }
> > > }
> > >
> > > If "refresh" is "yes", inotify is used to monitor the file,
> > > automatically reloading changes. If an error occurs during reloading,
> > > all authorizations will fail until the file is next successfully
> > > loaded.
> >
> > I'm curious about the 'refresh' stuff:
> > a) If refresh=no is there a way to explicitly ask for a refresh
> > when some tool knows it's finished with fiddling with the file.
>
> If refresh=no, then you can still use object_del + object_add to
> recreate the ACL object which will cause new content to be picked
> up.
But if I have a VNC/NBD/etc listening, won't it be bound to the old
object, so I can't delete the old object?
> > b) am I right in thinking you're actually monitoring the directory
> > for changes and retriggering on directory changes? So it'll
> > trigger on the normal trick of renaming the modified file over the
> > original?
>
> I originally made the mistake of trying to monitor the file
> and discovered the awfulness of inotify :-(
>
> So, yeah, now we monitor the directory so we can trigger
> reloads even when the file is editted by doing a tmpfile+rename
> dance.
>
> The inotify support in the early patch in this series is intelligent
> so that if multiple objects all monitor the same directory we only
> use a single inotify watch.
>
> > c) I'm a little concerned about making it automatic; if all the qemus
> > on a system all wake up and reparse the file at the same time.
>
> I don't think its a big deal in this case because the files in
> question are very small. Once one QEMU reads it, the kernel will
> have content in I/O cache, and the CPU overhead of parsing the JSON
> will be lost in the noise given likely file sizes IMHO.
OK.
Dave
> Regards,
> Daniel
> --
> |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o- https://fstop138.berrange.com :|
> |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
--
Dr. David Alan Gilbert / address@hidden / Manchester, UK
- [Qemu-devel] [PATCH v3 02/11] qom: don't require user creatable objects to be registered, (continued)
- [Qemu-devel] [PATCH v3 02/11] qom: don't require user creatable objects to be registered, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v3 03/11] hw/usb: don't set IN_ISDIR for inotify watch in MTP driver, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v3 01/11] util: add helper APIs for dealing with inotify in portable manner, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v3 04/11] hw/usb: fix const-ness for string params in MTP driver, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v3 05/11] hw/usb: switch MTP to use new inotify APIs, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v3 07/11] authz: add QAuthZSimple object type for easy whitelist auth checks, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v3 06/11] authz: add QAuthZ object as an authorization base class, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v3 09/11] authz: add QAuthZListFile object type for a file access control list, Daniel P . Berrangé, 2018/06/20
[Qemu-devel] [PATCH v3 08/11] authz: add QAuthZList object type for an access control list, Daniel P . Berrangé, 2018/06/20
[Qemu-devel] [PATCH v3 10/11] authz: add QAuthZPAM object type for authorizing using PAM, Daniel P . Berrangé, 2018/06/20
[Qemu-devel] [PATCH v3 11/11] authz: delete existing ACL implementation, Daniel P . Berrangé, 2018/06/20