Merge pull request sonic-net#54 from mikelazar/master

HLD - D-Bus Container to Host Communications
mikelazar · Dec 17, 2019 · d17d2a4 · d17d2a4
2 parents 61626bf + 881fc5b
commit d17d2a4
Showing 1 changed file with 20 additions and 9 deletions.
diff --git a/doc/mgmt/Docker to Host communication.md b/doc/mgmt/Docker to Host communication.md
@@ -18,7 +18,10 @@ Docker to Host communication
 | Rev |     Date    |       Author       | Change Description                |
 |:---:|:-----------:|:------------------:|-----------------------------------|
 | 0.1 | 10/28/2019  | Nirenjan Krishnan  | Initial version                   |
-| 0.2 | 12/08/2019  | Mike Lazar         | Add security and design info      |
+|:---:|:-----------:|:------------------:|-----------------------------------|
+| 0.2 | 12/08/2019  | Mike Lazar         | Add details about architecture    |
+|:---:|:-----------:|:------------------:|-----------------------------------|
+| 0.3 | 12/16/2019  | Mike Lazar         | Add security and logging info     |
 
 
 # About this Manual
@@ -33,9 +36,9 @@ however, it does not describe the individual host-specific features.
 # Definition/Abbreviation
 
 ### Table 1: Abbreviations
-| **Term**                 | **Meaning**                         |
-|--------------------------|-------------------------------------|
-| XYZ                      | Term description                    |
+| **Term**                 | **Meaning**                                       |
+|--------------------------|---------------------------------------------------|
+| D-Bus                    | Desktop Bus: https://en.wikipedia.org/wiki/D-Bus  |
 
 # 1 Feature Overview
 
@@ -58,6 +61,9 @@ the Docker container and the host.
   host.
 * The host communication API shall be available in Translib, and shall provide
   both synchronous and asynchronous communication methods.
+* It shall be possible to configure the identity of the Linux user accounts who have access to a D-Bus socket.
+* It shall be possible to configure containers in such a way that only certain containers (e.g. SONiC Mgmt.)
+  have access to the D-Bus socket.
 
 ### 1.1.2 Configuration and Management Requirements
 
@@ -76,7 +82,7 @@ N/A
 
 The code will extend the existing Translib modules to provide a D-Bus based
 query API to issue requests to the host. The host service will be a Python based
-application which listens on known D-Bus endpoints.
+application which listens on known D-Bus endpoints.https://en.wikipedia.org/wiki/D-Bus
 
 The individual app modules can extend the host service by providing a small
 Python snippet that will register against their application endpoint.
@@ -119,16 +125,21 @@ channel (asynchronous request).
 The architecture of a D-Bus host service in a SONiC environment is illustrated in the diagram below:
 ![](images/docker-to-host-services-architecture.jpg)
 
-Note. The Linux D-Bus implementation uses Unix domain sockets for client to D-Bus service communications. 
-All containers that use D-Bus services will bind mount 
+Note. The Linux D-Bus implementation uses Unix domain sockets for client to D-Bus service communications.
+All containers that use D-Bus services will bind mount
 (-v /var/run/dbus:/var/run/dbus:rw) the host directory where D-Bus service sockets are created.
+This ensures that only the desired containers access the D-Bus host services.
 
 D-Bus provides a reliable communication channel between client (SONiC management container) and service (native host OS) – all actions are acknowledged and can provide return values. It should be noted that acknowledgements are important for operations such as “image upgrade” or “config-save”. In addition, D-Bus methods can return values of many types – not just ACKs. For instance, they can return strings, useful to return the output of a command.
 
-
 ### 3.1.1 Security of D-Bus Communications
 In addition to standard Linux security mechanisms for file/Unix socket access rights (read/write), D-Bus provides a separate security layer, using the D-Bus service configuration files.
-This allows finer grain access control to D-Bus objects and methods.
+This allows finer grain access control to D-Bus objects and methods - D-Bus can restrict access only to certain Linux users.
+
+### 3.1.2 Command Logging
+
+It is possible to track and log the user name and the command that the user has requested.
+The log record is created in the system log.
 
 ## 3.2 DB Changes
 ### 3.2.1 CONFIG DB