Indication subscription for pegasus user

Jan Safranek jsafrane at redhat.com
Tue Jan 7 11:46:24 UTC 2014


On 01/03/2014 01:30 PM, Radek Novacek wrote:
> I've noticed that we suggest our users that they should use the 'pegasus' user 
> for connection to pegasus, for example in the Quick Start Guide [1].
> 
> But the default pegasus configuration forbids non-privileged users to create 
> indication subscriptions. This affects the 'pegasus' user. When someone 
> connects to the pegasus using 'pegasus' user, he can't create any 
> subscription, unless it's explicitly allowed in the pegasus configuration: 
> 
> (from man cimconfig):
> 
> enableSubscriptionsForNonprivilegedUsers
> 
>               Description: If True, nonprivileged user of the system will be 
> allowed to create Indication Subscription, otherwise privileged access is 
> required.
>               Default Value: False
>               Dynamic: No
> 
> 
> I think that this behavior is very confusing for our users, we should do one 
> of the following options:
> 
> 1) stick with current way - user must change that option in order to create 
> subscription as 'pegasus' (or other non-root) user and document it,
> 
> 2) allow 'pegasus' user to create indication subscriptions by default (don't 
> know if pegasus supports some kind of whitelisting of users),
>
> 3) mark 'pegasus' user as privileged (not sure if possible),

Looking into sources, Pegasus checks for uid == 0, all other users are
'unprivileged'.


> 4) Turn option 'enableSubscriptionsForNonprivilegedUsers' on by default, 
> 
> 5) something else, suggestions welcomed.
> 
> 
> I like the 2) most, but I'm not sure if it's possible to do it easily. Maybe 
> we should consult pegasus upstream why is it done this way.
> 
> What do you think?

Both #2 and #3 need some changes in Pegasus sources, so I would use #4 -
set enableSubscriptionsForNonprivilegedUsers in default config. If an
user can read an object, it should be allowed to subscribe to its events.

If an admin wants something else, he can set read-only privileges on
root/interop namespace for the respective user.

Please create appropriate bugs in our Bugzilla.

Jan


More information about the openlmi-devel mailing list