On Fri, Sep 22, 2017 at 12:55:24PM +0100, Daniel P. Berrange wrote: > On Fri, Sep 22, 2017 at 07:43:39AM -0400, Chuck Lever wrote: > > If firewall configuration is a chronic problem, let's address that. > > This just isn't practical in the general case. Even on a single Linux OS > distro there are multiple ways to manage firewalls (Fedora as a static > init script, or firewalld, and many users invent their own personal way > of doing it). There are countless other OS, many closed source with 3rd > party firewall products in use. And then there are the firewall policies > defined by organization's IT departments that mandate particular ways of > doing things with layers of approval to go through to get changes made. > > IOW, while improving firewall configuraiton is a worthy goal, it isn't > a substitute for host<->guest file system sharing over a non-network > based transport. I guess what's confusing to me is you're already depending on a ton of assumptions about the guest: - it has to be running a recent kernel with NFS/VSOCK support. - it has to have all the nfs-utils userspace stuff, a /usr/bin/mount that works the way you expect, and an /etc/nfsmount.conf that doesn't have any odd options. - it has to have a suitable mount point somewhere that the admin knows about. - probably lots of other stuff It's odd that the firewall configuration is the one step too far. As long as we've got all these requirements on guests, is there no chance we could add a requirement like "if you want shared filesystems, outbound tcp connections to port 2049 must be permitted on interface vhost0". ? --b. -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
