Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Eric Blake
On 09/20/2012 08:46 AM, Daniel P. Berrange wrote: >> You still didn't answer my bigger question - when migrating, do we care >> about the case where the same user name has different uid on the two >> machines, and if so, do we make it possible for the user to choose >> between migrating with const

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Marcelo Cerri
On Thu, Sep 20, 2012 at 02:53:52PM +0200, Peter Krempa wrote: > On 09/19/12 23:32, Marcelo Cerri wrote: > >The DAC driver is missing parsing of group and user names for DAC labels > >and currently just parses uid and gid. This patch extends it to support > >names, so the following security label de

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Marcelo Cerri
On Thu, Sep 20, 2012 at 08:43:35AM -0600, Eric Blake wrote: > On 09/20/2012 07:31 AM, Marcelo Cerri wrote: > >>> possible ambiguities (since it is legal [although stupid] to have a user > >>> name consisting of all digits and worse having the name differ from the > >>> underlying uid), > > >> The

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Daniel P. Berrange
On Thu, Sep 20, 2012 at 08:43:35AM -0600, Eric Blake wrote: > On 09/20/2012 07:31 AM, Marcelo Cerri wrote: > >>> possible ambiguities (since it is legal [although stupid] to have a user > >>> name consisting of all digits and worse having the name differ from the > >>> underlying uid), > > >> The

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Eric Blake
On 09/20/2012 07:31 AM, Marcelo Cerri wrote: >>> possible ambiguities (since it is legal [although stupid] to have a user >>> name consisting of all digits and worse having the name differ from the >>> underlying uid), >> The other option (that I prefer more) would be to document this >> behavior

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Marcelo Cerri
On Thu, Sep 20, 2012 at 03:00:17PM +0200, Peter Krempa wrote: > On 09/20/12 02:31, Eric Blake wrote: > >On 09/19/2012 03:32 PM, Marcelo Cerri wrote: > >>The DAC driver is missing parsing of group and user names for DAC labels > >>and currently just parses uid and gid. This patch extends it to suppo

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Peter Krempa
On 09/20/12 02:31, Eric Blake wrote: On 09/19/2012 03:32 PM, Marcelo Cerri wrote: The DAC driver is missing parsing of group and user names for DAC labels and currently just parses uid and gid. This patch extends it to support names, so the following security label definition is now valid:

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-20 Thread Peter Krempa
On 09/19/12 23:32, Marcelo Cerri wrote: The DAC driver is missing parsing of group and user names for DAC labels and currently just parses uid and gid. This patch extends it to support names, so the following security label definition is now valid: qemu:qemu qemu:qemu ---

Re: [libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-19 Thread Eric Blake
On 09/19/2012 03:32 PM, Marcelo Cerri wrote: > The DAC driver is missing parsing of group and user names for DAC labels > and currently just parses uid and gid. This patch extends it to support > names, so the following security label definition is now valid: > > > qemu:qemu > qemu:

[libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels

2012-09-19 Thread Marcelo Cerri
The DAC driver is missing parsing of group and user names for DAC labels and currently just parses uid and gid. This patch extends it to support names, so the following security label definition is now valid: qemu:qemu qemu:qemu --- src/security/security_dac.c | 49 +