{"action":"created","issue":{"url":"https://api.github.com/repos/flux-framework/rfc/issues/74","repository_url":"https://api.github.com/repos/flux-framework/rfc","labels_url":"https://api.github.com/repos/flux-framework/rfc/issues/74/labels{/name}","comments_url":"https://api.github.com/repos/flux-framework/rfc/issues/74/comments","events_url":"https://api.github.com/repos/flux-framework/rfc/issues/74/events","html_url":"https://github.com/flux-framework/rfc/pull/74","id":205463643,"number":74,"title":"update security model with per-message userid and capmask","user":{"login":"garlick","id":169947,"avatar_url":"https://avatars.githubusercontent.com/u/169947?v=3","gravatar_id":"","url":"https://api.github.com/users/garlick","html_url":"https://github.com/garlick","followers_url":"https://api.github.com/users/garlick/followers","following_url":"https://api.github.com/users/garlick/following{/other_user}","gists_url":"https://api.github.com/users/garlick/gists{/gist_id}","starred_url":"https://api.github.com/users/garlick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garlick/subscriptions","organizations_url":"https://api.github.com/users/garlick/orgs","repos_url":"https://api.github.com/users/garlick/repos","events_url":"https://api.github.com/users/garlick/events{/privacy}","received_events_url":"https://api.github.com/users/garlick/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":18,"created_at":"2017-02-05T23:30:51Z","updated_at":"2017-02-09T00:48:05Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/flux-framework/rfc/pulls/74","html_url":"https://github.com/flux-framework/rfc/pull/74","diff_url":"https://github.com/flux-framework/rfc/pull/74.diff","patch_url":"https://github.com/flux-framework/rfc/pull/74.patch"},"body":"This PR adds _userid_ and _capmask_ fields to RFC 3 messages, and discusses how they are to be used in RFC 12.\r\n\r\nIncomplete and not for merging yet, as I wanted to get a bit of feedback on the \"overview\" rewrite in RFC 12 before adding details to that RFC.  Perhaps it goes too far though - let me know if I should leave out the bits about deferring setuid/containment to privileged executable."},"comment":{"url":"https://api.github.com/repos/flux-framework/rfc/issues/comments/278511479","html_url":"https://github.com/flux-framework/rfc/pull/74#issuecomment-278511479","issue_url":"https://api.github.com/repos/flux-framework/rfc/issues/74","id":278511479,"user":{"login":"garlick","id":169947,"avatar_url":"https://avatars.githubusercontent.com/u/169947?v=3","gravatar_id":"","url":"https://api.github.com/users/garlick","html_url":"https://github.com/garlick","followers_url":"https://api.github.com/users/garlick/followers","following_url":"https://api.github.com/users/garlick/following{/other_user}","gists_url":"https://api.github.com/users/garlick/gists{/gist_id}","starred_url":"https://api.github.com/users/garlick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garlick/subscriptions","organizations_url":"https://api.github.com/users/garlick/orgs","repos_url":"https://api.github.com/users/garlick/repos","events_url":"https://api.github.com/users/garlick/events{/privacy}","received_events_url":"https://api.github.com/users/garlick/received_events","type":"User","site_admin":false},"created_at":"2017-02-09T00:48:05Z","updated_at":"2017-02-09T00:48:05Z","body":"It seems like this gets complicated quickly.  In order to make progress with this design I'm going to propose that for the near term we assume one administrative domain for Flux and state what that means in the RFC.  If there's a specific use case I'm forgetting that makes this assumption a bad one to make right now, please remind me.\r\n\r\nThe only thing that bugs me a little is it might be possible to do something with idmapd to allow Flux to both piggy back on existing user mappings, and do so consistently with a shared NFSv4 file system.  This might be especially useful in a workgroup environment (e.g. workstations without consistent uids but with a shared NFSv4 file system).   However, it feels like too much of a diversion before we've nailed down a first cut.\r\n\r\nI'm assuming full grid mode like [globus](https://www.globus.org/) is not something anybody is pushing?"}}
{"actor":{"display_login":"garlick"}}