Open Stack

Hi

On 2 August 2013 11:15, Daniel P. Berrange <berrange at redhat.com> wrote:

> better is really missing the bigger picture. In Linux, there has been
> a move away from use of sudo or similar approaches, towards the idea
> of having privileged separated services. So if you wanted todo stuff
>

I think it would be fair to say that this move has happened significantly
more in the desktop world than the server world?


> related to storage, you'd have some small daemon running privilegd,
> which exposed APIs over DBus, which the non-privileged thing would
>

There are several things that worry me about this suggestion:

 * DBus isn't super pleasing to work with as a developer or a sysadmin
 * AIUI it doesn't offer very many guarantees about message delivery or
high availability


> Of course this is alot more work than just hacking up some scripts
> using sudo or rootwrap. That's the price you pay for properly
> engineering formal APIs todo jobs instead of punting to random
> shell scripts.
>

Given the sorts of things that OpenStack components need to run with
privileges, I strongly suspect that even if you wedge DBus in the middle of
things, you'll still be "punting to random shell scripts" on the backend,
unless the tools on Linux servers are about to grow a heck of a lot of
APIs. At that point I'm not really sure you've gained anything other than
making the whole process more complicated and significantly harder to debug.

-- 
Cheers,

Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20130802/599efa94/attachment.html>