From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52881) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YIw7E-0000LX-LL for qemu-devel@nongnu.org; Wed, 04 Feb 2015 04:19:25 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YIw78-0007e8-Fs for qemu-devel@nongnu.org; Wed, 04 Feb 2015 04:19:20 -0500 Received: from mx1.redhat.com ([209.132.183.28]:39447) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YIw78-0007dt-8E for qemu-devel@nongnu.org; Wed, 04 Feb 2015 04:19:14 -0500 Date: Wed, 4 Feb 2015 09:19:07 +0000 From: "Daniel P. Berrange" Message-ID: <20150204091907.GF3032@redhat.com> References: <1421078294-26234-1-git-send-email-berrange@redhat.com> <54D148A8.1030506@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <54D148A8.1030506@redhat.com> Subject: Re: [Qemu-devel] [PATCH v2] qga: add guest-set-admin-password command Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: qemu-devel@nongnu.org, Michael Roth On Tue, Feb 03, 2015 at 03:16:08PM -0700, Eric Blake wrote: > On 01/12/2015 08:58 AM, Daniel P. Berrange wrote: > > Add a new 'guest-set-admin-password' command for changing the > > root/administrator password. This command is needed to allow > > OpenStack to support its API for changing the admin password > > on a running guest. > > > > Accepts either the raw password string: > > > > $ virsh -c qemu:///system qemu-agent-command f21x86_64 \ > > '{ "execute": "guest-set-admin-password", "arguments": > > { "crypted": false, "password": "12345678" } }' > > {"return":{}} > > > > Or a pre-encrypted string (recommended) > > > > $ virsh -c qemu:///system qemu-agent-command f21x86_64 \ > > '{ "execute": "guest-set-admin-password", "arguments": > > { "crypted": true, "password": > > "$6$T9O/j/aGPrE...snip....rQoRN4F0.GG0MPjNUNyml." } }' > > > > NB windows support is desirable, but not implemented in this > > patch. > > > > Signed-off-by: Daniel P. Berrange > > --- > > qga/commands-posix.c | 90 ++++++++++++++++++++++++++++++++++++++++++++++++++++ > > qga/commands-win32.c | 6 ++++ > > qga/qapi-schema.json | 19 +++++++++++ > > 3 files changed, 115 insertions(+) > > > > > +++ b/qga/qapi-schema.json > > @@ -738,3 +738,22 @@ > > ## > > { 'command': 'guest-get-fsinfo', > > 'returns': ['GuestFilesystemInfo'] } > > + > > +## > > +# @guest-set-admin-password > > +# > > +# @crypted: true if password is already crypt()d, false if raw > > +# @password: the new password entry > > +# > > +# If the @crypted flag is true, it is the callers responsibility > > s/callers/caller's/ > > > +# to ensure the correct crypt() encryption scheme is used. This > > +# command does not attempt to interpret or report on the encryption > > +# scheme. Refer to the documentation of the guest operating system > > +# in question to determine what is supported. > > +# > > +# Returns: Nothing on success. > > +# > > +# Since 2.3 > > +## > > +{ 'command': 'guest-set-admin-password', > > + 'data': { 'crypted': 'bool', 'password': 'str' } } > > > > Normally, 'password':'str' means we are passing UTF8 JSON. But what if > the desired password is NOT valid UTF8, but still valid to the end user > (for example, a user that intentionally wants a Latin1 encoded password > that uses 8-bit characters)? In other interfaces, we've allowed an enum > that specifies whether a raw data string is 'utf8' or 'base64' encoded; > should we have such a parameter here? IMHO, QEMU itself needs to avoid interpreting the password at all and just pass the raw bytes through to the operating system specific command as-is. ie we should be 8-bit pure in what we accept. This probably argues for unconditionally using base64 encoded data for the parameter. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|