Multiple policies for an object

Jim Meyering jim at meyering.net
Tue Oct 4 14:16:45 UTC 2011


Jeff Darcy wrote:
> Right now, iwhd looks for a policy on an object when its contents are
> added/changed.  If no policy is found, it looks instead on the object's bucket.
>  A potential (large) user has asked whether an object could be subject to
> multiple policies.  Creating a combined "super-policy" to cover objects that
> are subject to multiple regular policies - each of which might itself be
> arbitrarily complex - could be a nightmare when those underlying policies
> change.  Instead, I'd like to suggest that we extend the policy DSL with an
> "include" operator that effectively pulls in a policy on another object (or
> "_default" pseudo-object.  So, for example, you could have the following:
>
> 	bucket1/object1: $location == "north america"
> 	bucket2/_default: $security == "high"
> 	bucket2/object2: ^bucket1/object1 && ^bucket2/_default
>
> What this would do, effectively, is replicate object2 only if both of the other
> conditions are met.  Either could then be changed, and the composite policy on
> object2 would reflect the change.  Some of the handling for this sort of
> external reference already exists for the T_LINK ($object1.pointer) syntax,
> thought this would be slightly more complex because the target would have to be
> parsed and the result spliced in to the current parse tree.
>
> If people still believe this would be useful enough to be worth doing, I could
> contribute the patch.  Any thoughts?

That looks useful, and not too onerous.
Combined with "large user" demand (even if only "potential")
and the offer of a patch, I can't refuse.

The questions are whether it is important and/or feasible to see this in
iwhd-1.0.  If you can write the patch (preferably w/doc, test and NEWS)
this week, then it's probably feasible.

Thanks!


More information about the iwhd-devel mailing list