<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: times new roman,new york,times,serif; font-size: 12pt; color: #000000'>Hi,<br>of course, you're right. Allowing users to define the FILES is a potential security issue.<br>It would still be nice to enable users to update the other template parameters (e.g. image ID).<br><br>I know that this is way more complicated, as each individual parameter would have to be checked.<br><br>BR,<br>Steffen <br><br><hr id="zwchr"><blockquote style="border-left:2px solid rgb(16, 16, 255);margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;">Hi<div><br></div><div>Not all CONTEXT attributes are restricted, it is only FILES. So we only let oneadmin use CONTEXT/FILES. The rationale behind this is that CONTEXT/FILES means accessing the filesystem using oneadmin priviledges, and so you can use:</div>
<div><br></div><div>CONTEXT= [</div><div> FILES = "/var/lib/one/one.db /etc/passwd" </div><div>]</div><div><br></div><div>and now you have access to the whole one.db or passwd file of the frontend. </div><div>
<br>
</div><div>However this maybe safe depending on your setup, e.g. you only let users access through EC2 or OCCI...</div><div><br></div><div>If you can live with that, simply drop the </div><div><div><br></div><div>VM_RESTRICTED_ATTR = "CONTEXT/FILES"</div>
<div><br></div><div>in oned.conf</div><div><br></div><div>Cheers</div><div><br></div><div>Ruben<br><br><div class="gmail_quote">On Fri, Oct 26, 2012 at 2:53 PM, Steffen Claus <span dir="ltr"><<a href="mailto:steffen.claus@scai.fraunhofer.de" target="_blank">steffen.claus@scai.fraunhofer.de</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
i have a general question regarding the handling of VM-templates with CONTEXT parameters.<br>
I know that the owner has to be either "oneadmin" or a member of the "oneadmin" group.<br>
Since ONE 3.4 it is possible to grant USE-rights on such templates for normal users.<br>
So far, so good.<br>
<br>
But now I would also like to change the owner of the template to a normal user. Why is this not possible? What are the main concerns that led to the decision to only allow "oneadmin" to define CONTEXT parameters, respectively, possess templates with such parameters? Are there any best practices how to handle this problem?<br>
<br>
BR,<br>
Steffen Claus<br>
<br>
<br>
<br>
--<br>
Steffen Claus<br>
<br>
Fraunhofer-Institut für Algorithmen und Wissenschaftliches Rechnen (SCAI)<br>
Schloss Birlinghoven<br>
D-53754 Sankt Augustin<br>
Tel: <a href="tel:%2B49%202241%2014-2511" target="_blank">+49 2241 14-2511</a><br>
<a href="mailto:steffen.claus@scai.fraunhofer.de" target="_blank">steffen.claus@scai.fraunhofer.de</a><br>
<a href="http://www.scai.fraunhofer.de" target="_blank">http://www.scai.fraunhofer.de</a><br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Ruben S. Montero, PhD<br>Project co-Lead and Chief Architect<br>OpenNebula - The Open Source Solution for Data Center Virtualization<br><a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:rsmontero@opennebula.org" target="_blank">rsmontero@opennebula.org</a> | @OpenNebula<br>
</div></div>
</blockquote><br><br><br>-- <br><div><span name="x"></span>Steffen Claus<br><br>Fraunhofer-Institut für Algorithmen und Wissenschaftliches Rechnen (SCAI)<br>Schloss Birlinghoven<br>D-53754 Sankt Augustin<br>Tel: +49 2241 14-2511<br>steffen.claus@scai.fraunhofer.de<br>http://www.scai.fraunhofer.de <span name="x"></span><br></div></div></body></html>