Multiple policies for an object
Jim Meyering
jim at meyering.net
Tue Oct 4 14:16:45 UTC 2011
Jeff Darcy wrote:
> Right now, iwhd looks for a policy on an object when its contents are
> added/changed. If no policy is found, it looks instead on the object's bucket.
> A potential (large) user has asked whether an object could be subject to
> multiple policies. Creating a combined "super-policy" to cover objects that
> are subject to multiple regular policies - each of which might itself be
> arbitrarily complex - could be a nightmare when those underlying policies
> change. Instead, I'd like to suggest that we extend the policy DSL with an
> "include" operator that effectively pulls in a policy on another object (or
> "_default" pseudo-object. So, for example, you could have the following:
>
> bucket1/object1: $location == "north america"
> bucket2/_default: $security == "high"
> bucket2/object2: ^bucket1/object1 && ^bucket2/_default
>
> What this would do, effectively, is replicate object2 only if both of the other
> conditions are met. Either could then be changed, and the composite policy on
> object2 would reflect the change. Some of the handling for this sort of
> external reference already exists for the T_LINK ($object1.pointer) syntax,
> thought this would be slightly more complex because the target would have to be
> parsed and the result spliced in to the current parse tree.
>
> If people still believe this would be useful enough to be worth doing, I could
> contribute the patch. Any thoughts?
That looks useful, and not too onerous.
Combined with "large user" demand (even if only "potential")
and the offer of a patch, I can't refuse.
The questions are whether it is important and/or feasible to see this in
iwhd-1.0. If you can write the patch (preferably w/doc, test and NEWS)
this week, then it's probably feasible.
Thanks!
More information about the iwhd-devel
mailing list