On Fri, Sep 20, 2024 at 01:53:41PM +0200, Peter Krempa wrote:
> On Fri, Sep 20, 2024 at 15:24:03 +0400, Marc-André Lureau wrote:
> > Hi
> >
> > On Thu, Sep 19, 2024 at 10:05 PM Stefan Berger <stefanb@xxxxxxxxxxxxx> wrote:
> > >
> > > Extend the schema for the TPM emulator profile node. Require that
> > > the profile the user provides looks like a JSON map that at least
> > > starts with '{' and ends with '}'.
> > >
> > > Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
> > > ---
> > > src/conf/schemas/basictypes.rng | 6 ++++++
> > > src/conf/schemas/domaincommon.rng | 17 +++++++++++++++++
> > > 2 files changed, 23 insertions(+)
> > >
> > > diff --git a/src/conf/schemas/basictypes.rng b/src/conf/schemas/basictypes.rng
> > > index 2931e316b7..06df0fe67e 100644
> > > --- a/src/conf/schemas/basictypes.rng
> > > +++ b/src/conf/schemas/basictypes.rng
> > > @@ -677,4 +677,10 @@
> > > </element>
> > > </define>
> > >
> > > + <define name="JSONMap">
> > > + <data type="string">
> > > + <param name="pattern">\{.*\}</param>
> > > + </data>
> > > + </define>
> >
> > It's unfortunate, but I think this should rather be XML and converted
> > to JSON internally (after all, that's part of what libvirt does with
> > QEMU configuration, somehow)
>
> Yeah, having arbitrary JSON is weird and also bypasses the philosophy
> that libvirt should express in the schema only what we really support
> (E.g. no raw arbitrary value passthrough, unless explicitly marked as
> without guarantees)
IMHO, we should not be defining raw crypto profiles in the XML at
all, whether JSON or not. I don't see profile definitions as being
something that needs to change per-VM definition. This is a case
where there ought to be a set of common profiles defined, and just
referenced by name at the VM configuration level.
IOW swtpm itself is fully configurable which makes sense, but we
don't need to expose this up to the libvirt level.
Instead I think there should be a defined standard for how an distro
package, or host sysadmin, would "drop in" a profile definition to
a well defined directory, where upon we can reference it by name in
libvirt,
eg define two dirs
/usr/share/swptm/profiles/<name>.json (for os distro)
/etc/swptm/profiles/<name>.json (for local deployment)
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
