On Mon, Feb 04, 2013 at 11:52:41AM +0100, Martin Kletzander wrote:
> Connection to this interface will be:
>
> - available even when no normal/priority workers are available,
>
> - distinguished (or completely separated) from other daemon
> connections,
>
> - (should be) more restricted than other connections.
>
> Having the connection available with all the worker threads being
> blocked/deadlocked creates the possibility of for example listing the
> connections even when all APIs block. Such manipulations mustn't be
> possible over the standard connections and that's why the connections
> should be distinguished. The connection restriction is hard to check,
> but the permissions for the socket should be less or equal to the rw
> socket with having no authentication only when rw socket has no
> authentication.
Completely agreed - the administrative inteface must always
be usable, regardless of anything a regular client might have
done.
> My idea is following:
>
> - new 'admin_protocol.x' with specification of new program,
Agreed, we want this completely independant of existing RPC programs.
> - default connection limitation to this interface to only root-owned
> socket with 700 (authentication optional, see above), so only root on
> the host can utilize it,
Agreed, making this kind of thing remote accessible is just asking
for trouble.
> - configurable number of admin workers, but with 1 as a default,
Yep, makes sense.
>
> - splitting usable parts of virsh and reusing them to create
> virsh-admin binary.
Or to following our more usual naming convention
virt-admin
> More controversial ideas I'd like to hear somebody else's opinion (even
> more than for the other things):
>
> - create a new separate library (libvirt-admin.so) to be used in the
> client, this library will have it's own virAdminConnect{,Auth}Open(),
> probably without an URI parameter (or with, but disabled for now, in
> case we want to enable remote connections later)
Yes, we want this library to be completely separate because we don't
want to make guarantees about long term ABI/API stability for this.
We should still use a URI format to connect, but this should be a
completely separate URI from the "normal" URIs, not least because a
admin connection is completely independant of any hypervisor.
Indeed this library should not even need to link to libvirt.so - it
can be completely standalone, because (unlike libvirt-qemu.so) these
APIs are completely separate from all existing APIs.
> - it is IMHO pointless to add a driver type for this, but it should
> definitely be configurable at compile time as well as in config
> (admin_workers = 0, maybe),
I don't think there's any compelling reason to disable this
separately from disabling of libvirtd itself. ie if you have
libvirtd built, then you should always have the admin service
and shell built too.
> - keep the connection handling on the current code and instead of
> duplicating much of it (so there will be a new service, much like the
> read-only socket, but for admin API only),
Yep, a new socket is inherantly required since we need separate
auth requirements
> - create a new pool of workers just for admin connections (similarly to
> the priority workers pool), with the dispatching being recognized by
> the protocol it is created in (remote, qemu, lxc protocols will go to
> normal/priority workers, whether admin protocol will be dispatched to
> the admin workers) and of course impossible from other connections
> than the admin one, which leads me to the next point;
Ok.
> - we can either add next flag for admin connection (similarly to the
> readonly one) or make it future-friendly and change the readonly bool
> into a virConnectionType enum (for example).
I'm not sure what you're refering to here, but opening admin connections
should be completely separate from existing connection opening APIs.
> I must admit, I'm probably doing something wrong or we have old
> documentation. Commands like 'make -C src rpcgen' don't work and I
> don't understand why admin_protocol-structs isn't automatically
> generated, but I've made it work for now.
You have to create the admin_protocol-structs file yourself - that is
the master ABI definition. The makefile creates a admin_protocol-struct
(notice lack of a trailing 's'), and compares it to the file you wrote
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list