Hi guys,
----- Original Message -----
> [...]
> With AF_UNIX, we get the connecting client's uid/gid/pid for free,
> which we pass along for PMAPI authentication purposes within PMCD. I
> propose pmlogger also use that information to extend the pmlogger ACL
> language to assert simple predicates like
>
> allow unix-uidmatch : all;
> # allow unix-gidmatch : all; # probably not a good default
> allow unix : enquire;
>
> which we could then put into the default / pmlogconf-generated files.
>
I wonder if we're over-thinking it - could we simplify things by just
insisting that the uid/gid match? The 99.9% case will be user/group
pcp/pcp I'd expect ... and the other 0.009% case would be some other
regular users pmlc to their own pmlogger. In both cases, it seems to
me it'd be perfectly fine to give a fully-authenticated local: style
connection read+write access, dispensing with even local host ACLs
for that special case.
There was another IRC question asked, which I'd really like to see us
tackle, and that is how to go about allowing the inet/ipv6 port to be
disabled completely if someone wishes (which we may want to make into
a default too at some point? IMO we should, once we have local: in).
One suggestion would be to add the (missing?!) -p <port> option here,
so that firstly we get command-line control over the pmlogger port (in
pmlogger I mean - pmlc already supports -p of course). At the moment,
we only have env var control (PMLOGGER_PORT), else its the hard-coded
port number we start from. Then extend with the ability to use "-p-"
and/or "-p 0" and/or "-p-1" meaning "no soup^Wports for you".
cheers.
--
Nathan
|