[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Xense-devel] ACM doesnt scale
xense-devel-bounces@xxxxxxxxxxxxxxxxxxx wrote on 06/24/2005 11:34:31 AM:
> On 6/24/05, Reiner Sailer <sailer@xxxxxxxxxx> wrote:
> > xense-devel-bounces@xxxxxxxxxxxxxxxxxxx wrote on 06/23/2005 09:19:16 PM:
> > > On 6/23/05, Steven Hand <Steven.Hand@xxxxxxxxxxxx> wrote:
> > > >
> > > > >at the moment, ACM supports only 2 models, and the code doesnt scale
> > > > >enough (at all) to support more models in the future? any plan to fix
> > > > >that?
> > > >
> > > > Yes - the current ACM code is a proof of concept derived from the
> > > > IBM sHype code. The model at present is that two policies (a primary
> > > > and secondary) will be in place at any time, although it is intended
> > > > that the selection of these will be more dynamic in the future. It's
> > > > not yet clear if extending this will be required, but we're certainly
> > > > aware of the structure and limitations of the current code.
> > > >
> > >
> > > also the way security models are integrated into ACM doesnt scale,
> > either.
> > Could you plesae be a little more specific about the "scaling"? What is
> > your
> > application of the ACM module that determines there's a "scaling" problem?
> at the moment, all the security models (chinesewall (A) and ste (B))
> are hard-coded, and we have 3 combinations of models (not count NULL
> policy): A, B and A_AND_B.
> i guess that there are more models to come in the future, suppose 3:
> C, D, E. so we will have much more combinations. and obviously the
> current organization of code in ACM doesnt scale to that change.
I'm not sure I would call that a scaling issue, but I understand your point. Obviously we realize the limits of the current implementation, and that there could indeed be many more reasonable and meaningful security policies in the future. Whether three or more would need to be active concurrently is an issue that is probably best discussed in the context of these other policies. Perhaps you have some thoughts on additional policies that would benefit from coexistence with the current (or other) set of policies?
Generally, I tend to agree with Steven, Keir and Rolf that there are more pressing issues to focus on in this space.
_______________________________________________ Xense-devel mailing list Xense-devel@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xense-devel
Lists.xenproject.org is hosted with RackSpace, monitoring our