Image permissions, round 2

Mark McLoughlin markmc at redhat.com
Thu Jun 9 12:04:05 UTC 2011


On Thu, 2011-06-09 at 13:57 +0200, Jim Meyering wrote:
> Mark McLoughlin wrote:
> ...
> >> Do we conflate 'create' and 'write' here? i.e. does the CLI only allow a
> >> user to create a new build for an image if the user has write access for
> >> that image? If we want to allow users to initiate new builds without
> >> write access on the top level image, then we'd need some way of
> >> determining who can do this -- or will we have to include this as an
> >> encoded "permission metadata tag" like you'd suggested for
> >> launch/execute" permissions above?
> >
> > See, what I'm struggling with here is that "create permission" in IWHD
> > only really makes sense on buckets. IWHD does not know the relationship
> > between images and builds, so you can set a create permission on image
> > objects and expect IWHD to prevent the creation of new build objects for
> > the image.
> 
> Hi Mark,
> 
> It looks like you meant s/can set/cannot set/.

Right, yes :)

Thanks,
Mark.



More information about the iwhd-devel mailing list