Image permissions, round 2
Mark McLoughlin
markmc at redhat.com
Thu Jun 9 12:04:05 UTC 2011
On Thu, 2011-06-09 at 13:57 +0200, Jim Meyering wrote:
> Mark McLoughlin wrote:
> ...
> >> Do we conflate 'create' and 'write' here? i.e. does the CLI only allow a
> >> user to create a new build for an image if the user has write access for
> >> that image? If we want to allow users to initiate new builds without
> >> write access on the top level image, then we'd need some way of
> >> determining who can do this -- or will we have to include this as an
> >> encoded "permission metadata tag" like you'd suggested for
> >> launch/execute" permissions above?
> >
> > See, what I'm struggling with here is that "create permission" in IWHD
> > only really makes sense on buckets. IWHD does not know the relationship
> > between images and builds, so you can set a create permission on image
> > objects and expect IWHD to prevent the creation of new build objects for
> > the image.
>
> Hi Mark,
>
> It looks like you meant s/can set/cannot set/.
Right, yes :)
Thanks,
Mark.
More information about the iwhd-devel
mailing list