Re: [PATCH nfs-utils v3 00/14] add NFS over AF_VSOCK support

["J. Bruce Fields" <bfields@fieldses.org>]

On Fri, Sep 22, 2017 at 12:55:24PM +0100, Daniel P. Berrange wrote:
> On Fri, Sep 22, 2017 at 07:43:39AM -0400, Chuck Lever wrote:
> > If firewall configuration is a chronic problem, let's address that.
> 
> This just isn't practical in the general case. Even on a single Linux OS
> distro there are multiple ways to manage firewalls (Fedora as a static
> init script, or firewalld, and many users invent their own personal way
> of doing it). There are countless other OS, many closed source with 3rd
> party firewall products in use. And then there are the firewall policies
> defined by organization's IT departments that mandate particular ways of
> doing things with layers of approval to go through to get changes made.
> 
> IOW, while improving firewall configuraiton is a worthy goal, it isn't
> a substitute for host<->guest file system sharing over a non-network
> based transport. 

I guess what's confusing to me is you're already depending on a ton of
assumptions about the guest:

	- it has to be running a recent kernel with NFS/VSOCK support.
	- it has to have all the nfs-utils userspace stuff, a
	  /usr/bin/mount that works the way you expect, and an
	  /etc/nfsmount.conf that doesn't have any odd options.
	- it has to have a suitable mount point somewhere that the admin
	  knows about.
	- probably lots of other stuff

It's odd that the firewall configuration is the one step too far.

As long as we've got all these requirements on guests, is there no
chance we could add a requirement like "if you want shared filesystems,
outbound tcp connections to port 2049 must be permitted on interface
vhost0".  ?

--b.