Image permissions, round 2

Jim Meyering jim at meyering.net
Thu Jun 9 11:57:33 UTC 2011


Mark McLoughlin wrote:
...
>> Do we conflate 'create' and 'write' here? i.e. does the CLI only allow a
>> user to create a new build for an image if the user has write access for
>> that image? If we want to allow users to initiate new builds without
>> write access on the top level image, then we'd need some way of
>> determining who can do this -- or will we have to include this as an
>> encoded "permission metadata tag" like you'd suggested for
>> launch/execute" permissions above?
>
> See, what I'm struggling with here is that "create permission" in IWHD
> only really makes sense on buckets. IWHD does not know the relationship
> between images and builds, so you can set a create permission on image
> objects and expect IWHD to prevent the creation of new build objects for
> the image.

Hi Mark,

It looks like you meant s/can set/cannot set/.


More information about the iwhd-devel mailing list