Re: [Kimchi-devel] [PATCH v2 0/4] Github #329: "YOU SHALL NOT ... run as root!"

on 2014/04/09 04:50, Daniel Barboza wrote: Excellent investigation work and nice patch! Since the nginx is already run in non-root mode and forward the request to Kimchi, it seems there is no need to separate kimchi-backend and kimchi-frontend. The solution in this patch series does not improve security but makes the internal of kimchi unnecessarily complicated. This is because nginx forwards requests directly to kimchi-backend and kimchi-frontend. The kimchi-backend and kimchi-frontend are in the same level. To truly make it a secure architecture, the kimchi-backend should sit behind kimchi-frontend, which means the following: nginx -> kimchi-frontend -> kimchi-backend(root). However if we had this nginx -> kimchi-frontend -> kimchi-backend(root), there would be no need to use nginx because kimchi-frontend is non-root already. A simpler solution might be that we can just have one kimchi process listening on localhost, and nginx on 0.0.0.0:8000/8001 and forward all the requests to kimchi. As regard to your RPC investigations, I'm fully agree with you on the opinion that objects are complex and not all objects are serialize. Consider the complexity and variance of third-party libraries, it's impossible to have an RPC solution that work seamless and transparently between a so-called kimchi-frontend(root) and kimchi-backend. On the other hand. There is a way that RPC should work if we don't have it run transparently. Suppose all models run in kimchi-backend(root), and it exposes a RPC interface explicitly via JSON RPC, D-BUS or whatever. And the objects passed to and returned from this RPC interfaces should be only of the simple kind such as list, string, integer, dict. Then all the controllers run in kimchi-frontend(non-root) and it listens on 0.0.0.0:8000/8001. The controller objects should make explicit RPC calls to the kimcih-backend(root). From my experience, seamless remote objects style of RPC is always a dead end, explicit style of RPC always works. In all, the RPC way may need more work, but it make perfect layered separation between the models and controllers. If we don't have a layered separation between the kimchi-frontend and kimchi-backend, there is no need to start two kimchi process, just one is enough, then have the nginx run in non-root and forward the requests. -- Thanks and best regards! Zhou Zheng Sheng / 周征晟 E-mail: zhshzhou(a)linux.vnet.ibm.com Telephone: 86-10-82454397