Hi, On Wed, Feb 29, 2012 at 11:36:46PM +0200, Alon Bar-Lev wrote: > > Scripts are for creative uses that the programmers of openvpn have not > > foreseen. Like "after the VPN is up, auto-sync all your git repositories" > > or "open up a few xterms with ssh's to $internalhosts". > > > > David had some other idea recently, which I forgot. > > This is a great example why this functionality should *MOVE OUT* of > the openvpn code base. > The UI can monitor OpenVPN and run scripts when such events are > detected via the management interface. > The UI already runs in the context of the interactive user.
But then you still have all the network, crypto and ssl stuff in the
privileged process - and the holy cow of security aware programming is
"keep the code base that runs privileged as small as possible".
So moving out the (very small) bits that need privileges and leaving
the rest in the runs-as-user code base is achieving the same thing
(scripts run with user privileges) with a much smaller code base for
privileged operations.
But I'm leaving this discussion now. Heiko is doing the implementation
work, James, David and I have agreed (and told the list via IRC session
minutes!) that we think it's a useful way forward, and this is developing
into a bikeshed.
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany g...@greenie.muc.de
fax: +49-89-35655025 g...@net.informatik.tu-muenchen.de
pgpMxaPkIwjQB.pgp
Description: PGP signature
