Re: Python in Domain Configurations

[Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>]

On Mon, Jul 24, 2023 at 01:28:24PM -0700, Elliott Mitchell wrote:
> On Fri, Jul 07, 2023 at 03:13:07PM -0700, Elliott Mitchell wrote:
> > 
> > The only context I could find was 54fbaf446b and
> > https://wiki.xenproject.org/wiki/PythonInXlConfig which don't explain
> > the reasoning.
> > 
> > Would the maintainers be amenable to revisiting the decision to remove
> > support for full Python in domain configuration files?
> 
> Any chance of this getting a response?
> 
> On examination it appears domain configuration files are a proper subset
> of Python.  The interface to the parser is a bit interesting, but it
> looks fairly simple to replace the parser with libpython.
> 
> My goal is to create an init script for some automatically started
> domains.  Issue is there can be ordering concerns with domain start/stop,
> and this seems best handled by adding an extra setting to the
> configuration files.  If full Python syntax is available, I can use that
> for this extra data.

Hi,

I don't know full history here, but from my point of view, having a
full-fledged script as a config file is undesirable for several reasons:
 - it's easy to have unintended side effects of just loading a config
   file
 - loading config file can no longer be assumed to be "cheap"
 - dynamic config file means you can no long rely on file timestamp/hash
   to check if anything changed (I don't think it's an issue for the
   current xl/libxl, but could be for some higher level tools)
 - leads to issues with various sandboxes - for example SELinux policy
   allowing scripted config file would be excessively permissive

So, IMHO reducing config file from a full python (like it used to be in
xend times) into a static file with well defined syntax was an
improvement. Lets not go backward.

As for your original problem, IIUC you would like to add some data that
would _not_ be interpreted by libxl, right? For that you can use
comments with some specific marker for your script. This approach used
to work well for SysV init script, and in fact for a very similar use case
(ordering and dependencies, among other things).

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

Attachment: signature.asc
Description: PGP signature