Add ability to build read-only version of httpserver-api module for monitoring purposes #820
Labels
Comments
nyh
added a commit
that referenced
this issue
Dec 25, 2016
Before this patch, mkbootfs.py, unlike upload_manifest.py, did not do stripping. This was leading to unnecessary inflating of the bootfs. With this patch, shared objects copied to the bootfs are also stripped. As an example, the image created by "scripts/build image=httpserver" goes down from 17 MB to 16 MB. Fixes #667. Refs #820. Signed-off-by: Yuri Volchkov <[email protected]> Signed-off-by: Nadav Har'El <[email protected]>
|
So, after commit 92c1d82 and commit c2a67b8 the size of the image created by "scripts/build image=httpserver" went down from 25 MB to 16 MB. The libhttpserver.so itself is just 1 MB of this size. So if you still want to modularize the REST apis for security or something, you can keep this issue open. But if it's only the size which bothered you, I think we can close this issue. |
|
Very glad to hear about the size. But my main motivation here is security. And I and am leaning toward the preprocessor-#if-type-of-solution as it seems simpler to implement and more in spirit of unikernels (only what you need). But I am interested in opinion of others. |
myechuri
pushed a commit
to myechuri/osv
that referenced
this issue
Jun 22, 2017
Before this patch, mkbootfs.py, unlike upload_manifest.py, did not do stripping. This was leading to unnecessary inflating of the bootfs. With this patch, shared objects copied to the bootfs are also stripped. As an example, the image created by "scripts/build image=httpserver" goes down from 17 MB to 16 MB. Fixes cloudius-systems#667. Refs cloudius-systems#820. Signed-off-by: Yuri Volchkov <[email protected]> Signed-off-by: Nadav Har'El <[email protected]>
wkozaczuk
changed the title
wkozaczuk
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently OSv REST apis provided by httpserver module can be used in all or nothing mode only.
It would be nice for security reasons to limit API to read-only subset (GETs) so that no state modification is possible. In general it should be possible to somehow customize set of available API. Also it would be nice to restrict what part of filesystem file API could access.
One way (static option) to accomplish this could done by enriching httpserver API code with preprocessor #if defined(OS_REBOOT_API_ENABLED) type of expressions. Another way (dynamic option) would be to use some kind of API configuration file specifying what APIs are enabled.
The text was updated successfully, but these errors were encountered: