From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-workers-return-38906-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 9281 invoked by alias); 21 Jul 2016 16:19:50 -0000
Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Workers List <zsh-workers.zsh.org>
List-Post: <mailto:zsh-workers@zsh.org>
List-Help: <mailto:zsh-workers-help@zsh.org>
X-Seq: 38906
Received: (qmail 22693 invoked from network); 21 Jul 2016 16:19:50 -0000
X-Qmail-Scanner-Diagnostics: from mail-lf0-f49.google.com by f.primenet.com.au (envelope-from <myllynen@redhat.com>, uid 7791) with qmail-scanner-2.11 
 (clamdscan: 0.99.2/21882. spamassassin: 3.4.1.  
 Clear:RC:0(209.85.215.49):SA:0(-0.0/5.0):. 
 Processed in 0.163604 secs); 21 Jul 2016 16:19:50 -0000
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-0.0 required=5.0 tests=SPF_PASS
	autolearn=unavailable autolearn_force=no version=3.4.1
X-Envelope-From: myllynen@redhat.com
X-Qmail-Scanner-Mime-Attachments: |
X-Qmail-Scanner-Zip-Files: |
Received-SPF: pass (ns1.primenet.com.au: SPF record at _netblocks.google.com designates 209.85.215.49 as permitted sender)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:reply-to:subject:references:to:cc:from
         :organization:message-id:date:user-agent:mime-version:in-reply-to
         :content-transfer-encoding;
        bh=PVFpUB63kzmjqX6wms8MI9WzEwv9jaurM+kYeVdgHZ8=;
        b=fmVboOB2rJ3mYshYGu1HjS60fQxiuOA2OdLYXaudfLfjTmyFFUbnrBfjAN4ImCDCWr
         1nD4oZHLw+ESkFJOYv0bTnC22KOBoGZD/l1uIKjVeLNzZrEwimMDmGQipRuDOSHK5q8B
         4vNGDdDo0GgGu1+4b3EoCv8qgMjTnSZuYtcAj6Uix8tDC9vNbvqnDsOT1fL88XtWXeT2
         2uVMZ0QDOWJ17TS5+GKPsg2j0OcGaYZ98A2FKFYrMWihpmbArtz7du+cyLEaFppjJL1l
         cxV4JA2c6RRbP1RiiQXuwPL838C+rHUSX1rKchQsKNeQ5NMmM1c2zdEGn0CWqMAU5wXS
         Hu9A==
X-Gm-Message-State: ALyK8tIiBvBtCwWpWb3olemn1Ch3t2GhnSs0z2CiiVXKrRBQ5w9qHtW28VjrD8Iz72hNQTq8
X-Received: by 10.25.38.149 with SMTP id m143mr10023969lfm.107.1469117981013;
        Thu, 21 Jul 2016 09:19:41 -0700 (PDT)
Reply-To: Marko Myllynen <myllynen@redhat.com>
Subject: Re: [PATCH] _virsh (Was: Re: zsh virsh completion)
References: <8eb6dce0-50d7-5ab2-503a-194c1de2e45d@redhat.com>
 <20160713045957.GA3893@tarsus.local2>
 <9968da53-c1fd-fa2a-f30c-c74f884d2478@redhat.com>
 <20160720065832.GA28939@tarsus.local2>
 <699166a0-b0f0-452c-2561-b7e3cc952062@redhat.com>
 <25001.1469117569@hydra.kiddle.eu>
To: Oliver Kiddle <okiddle@yahoo.co.uk>
Cc: zsh-workers@zsh.org
From: Marko Myllynen <myllynen@redhat.com>
Organization: Red Hat
Message-ID: <05372b5d-30fd-4cd3-68f7-e39a1996c73f@redhat.com>
Date: Thu, 21 Jul 2016 19:19:35 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.2
MIME-Version: 1.0
In-Reply-To: <25001.1469117569@hydra.kiddle.eu>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Hi,

On 2016-07-21 19:12, Oliver Kiddle wrote:
> Marko Myllynen wrote:
>> +      _values servers ${=${(S)${${(f)$(sudo virt-admin srv-list)}##*--- }//[0-9]* }} && return 0
> 
>> +      _values servers ${=${${(f):-"$(sudo virt-admin srv-clients-list --server $srv)"}/ [a-z]*}//[^0-9]} && return 0
> 
> I have pushed the change but I've just noticed these two lines. I'm not
> sure it is a good idea to be running sudo within completion functions.
> That can trigger logging and is often denied when you're already root.
> And there may be alternatives like doas.
> 
> There's also another instance of this in Mandriva/Command/_rebootin.
> 
> Anyone, have any thoughts on how this should be handled? I'm inclined
> to think that users should have to specifically set a gain-root
> style to enable this. Or perhaps it could only trigger if you
> complete after sudo virt-admin.

FWIW, I doublechecked the situation off-list with the virt-admin author
and currently there are no plans to allow non-root/non-sudo users to use
virt-admin (unlike with, e.g., virsh where it is already easy to
configure to allow full access for non-root users).

Thanks,

-- 
Marko Myllynen