[vdsm] Move some of code from spec file into vdsm-tool function issue

Federico Simoncelli fsimonce at redhat.com
Mon May 28 14:39:08 UTC 2012


----- Original Message -----
> From: "Lei Li" <lilei at linux.vnet.ibm.com>
> To: vdsm-devel at lists.fedorahosted.org
> Cc: "Adam Litke" <agl at us.ibm.com>, "Dan Kenigsberg" <danken at redhat.com>, "Federico Simoncelli" <fsimonce at redhat.com>,
> "Ryan Harper" <ryanh at linux.vnet.ibm.com>
> Sent: Monday, May 28, 2012 11:18:03 AM
> Subject: Move some of code from spec file into vdsm-tool function issue
> 
> Hi guys,
> 
> Adam point out a problem about my patch moving some of the
> post and preun section in vdsm spec file into vdsm-tool, and
> I have the same concern.
> 
> After some discussion, I'd like to ask for your suggestion
> on the patch as link below.
> 
> http://gerrit.ovirt.org/#patch,sidebyside,4528,3,vdsm.spec.in
> 
> Please let me know your idea, thanks!

VDSM is/was adding a password to libvirt to prevent anyone or anything
(eg: virt-manager, etc...) from managing the VMs that are controlled by
VDSM.

In general I don't like this idea for a couple of reasons: it's too much
intrusive (making modifications that are not expected) and it's using a
standard and known password, which is something debatable for many reasons
(even if it's doing well it's job of preventing careless mistakes).

I already tried to use polkit upstream (so that the vdsm user can manage
libvirt) and it worked pretty well, but it's not preventing other users
or other applications from connecting to libvirt and controlling the VMs.

Does anyone know if we still need this precaution? Is there any new feature
of libvirt that we can easily use to seal the access to our VMs?

-- 
Federico


More information about the vdsm-devel mailing list