[Engine-devel] Managing permissions on network

[Itamar Heim]

On 11/13/2012 07:18 PM, Livnat Peer wrote:
> On 13/11/12 15:39, Itamar Heim wrote:
>> On 11/13/2012 03:37 PM, Livnat Peer wrote:
>>> On 13/11/12 15:19, Itamar Heim wrote:
>>>> On 11/13/2012 12:45 PM, Livnat Peer wrote:
>>>>> Interesting point, I think that if a user has permission to create a VM
>>>>> from a specific template we should give him permission to use the
>>>>> template networks on this VM implicitly upon the VM creation.
>>>>
>>>> having a permission to a template does not mean a permission to the
>>>> default network of that VM, especially as we'll use templates more as
>>>> instance types.
>>>
>>> Another alternative is to require permission on the network as well as
>>> the template.
>>> I must say I don't really like it, although I agree with your comment,
>>> we require too many operations for enabling a user to create a VM from
>>> template (permission on the template, quota on the storage, permissions
>>> on the network, next we'll require a PHD ;)).
>>>
>>> Anyone has a better idea?
>>
>> I assume most networks would be given either to 'everyone' or groups of
>> users, not per user (and if the network is per user/tenant, then it must
>> be done per user.
>
> Which reminds that I wanted to propose adding a property on a network
> which is called public.
> It's just a UI feature to give a NetworkUser on this network to
> 'everyone'. It makes making a network public easier for the user.
>
> In addition during upgrade we should make all existing networks public
> networks and not allocate specific permissions for users on networks.
>
> In addition it also means a user is given permission on a network and
> then he can use it for any VM he owns. Isn't that problematic? We can't
> limit a user to use a network on a specific VM.

I think that's fine.
don't let user edit that vm if you don't trust them.

>
>> i may not remember correctly, but i thought when giving quota to user we
>> also give some permissions with it (on cluster and storage)?
>
> I am not sure what is the current implementation as it changed a lot,
> but last I tracked we checked for either quota or permissions we did not
> give implicit permissions when creating a quota.
>

gilad/doron?