From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49275) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZbVJ3-0005J9-LP for qemu-devel@nongnu.org; Mon, 14 Sep 2015 11:04:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZbVIy-0002NG-Rx for qemu-devel@nongnu.org; Mon, 14 Sep 2015 11:04:33 -0400 References: <1441951252-13439-1-git-send-email-famz@redhat.com> <55F2F141.3000809@redhat.com> <20150914063810.GA31803@ad.nay.redhat.com> From: Eric Blake Message-ID: <55F6E1E9.9090307@redhat.com> Date: Mon, 14 Sep 2015 09:04:09 -0600 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="vk9mQdorgthUf8RTDiGEGaJMk94H9csDF" Subject: Re: [Qemu-devel] [PATCH] iscsi: Add chap and "initiator-name" etc as per drive options List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Lieven , Fam Zheng Cc: Kevin Wolf , Paolo Bonzini , "qemu-block@nongnu.org" , qemu-devel , ronnie sahlberg This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --vk9mQdorgthUf8RTDiGEGaJMk94H9csDF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 09/14/2015 12:50 AM, Peter Lieven wrote: >>>> It would be nice to also add a matching BlockdevOptionsIscsi to >>>> qapi/block-core.json, to allow setting these structured options from= >>>> QMP. Separate patch is fine, but we need to do the work for ALL of = the >>>> remaining block devices eventually, and now that you are structuring= the >>>> command line is a good time to think about it. >>>> >>>> >>> Passing via command line is evil. It should still be possible to pass= >>> all this via a config file to qemu : >>> >> >> I agree passing password with clear text command line is bad, but -rea= dconfig >> doesn't work for qemu-img and qemu-io. Any idea how to make that work= ? >=20 > you can pass the secrets via environment variables (see libiscsi readme= ). Environment variables are no more secure than command line parameters - both are visible via ps to other processes, and hence relatively insecure. We need a way to pass secrets over a file descriptor, whether that file descriptor be a config file, or whether it be a pipe. --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --vk9mQdorgthUf8RTDiGEGaJMk94H9csDF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJV9uHtAAoJEKeha0olJ0Nqv0EIAJIvo3RrUcydeuP4Iy55Sp64 XqKVzCPO2gXhOs/C0sDTE84yr7Bj5BsjK+HkgTPETuL4u4bZc1kPNROaOFOGyTnT Exrw6RW96i6dVa9rgA0kpHpLtrLYOiybJwmAAnLfLOmxLok54NLylYGITcvfzWd5 ItEnGfSFkxPfKD6fYHRdt/R0hMV2NmFsqAE7j84Tf8t0dQ/pzZEUb6Jfyx+DPWg/ 3PLg4kqyvQrsByjIjQEe5c6mYSyNiHuW4kMBvtuuog9gR7LZfyJ/lMORhLdJnG8a eNoS87kuSqgdBajrltqgUfQq+WS+b04NfrkUGExPm/nWxVXkfGtlht/p7xeg7+A= =J23x -----END PGP SIGNATURE----- --vk9mQdorgthUf8RTDiGEGaJMk94H9csDF--