Re: [PATCH datacenter-manager 2/4] add api_cache as a specialized wrapper around the namespaced cache

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

On Wed, 13 May 2026 15:54:55 +0200, Lukas Wagner wrote:
> diff --git a/server/src/api_cache.rs b/server/src/api_cache.rs
> new file mode 100644
> --- /dev/null
> +++ b/server/src/api_cache.rs
> @@ -0,0 +1,126 @@
[...]
> +const GLOBAL_NAMESPACE: &str = "global";
> +const LOCK_TIMEOUT: Duration = Duration::from_secs(10);
> +
> +static CACHE: LazyLock<NamespacedCache> = LazyLock::new(|| {
> +    let file_options = proxmox_product_config::default_create_options();
> +    let dir_options = file_options.perm(Mode::from_bits_truncate(0o750));

w.r.t. 0o750 mode for per-namespace subdirectories here and ...

> +
> +    NamespacedCache::new(PathBuf::from(PDM_API_CACHE_PATH), dir_options, file_options)
> +});

> diff --git a/server/src/bin/proxmox-datacenter-privileged-api.rs b/server/src/bin/proxmox-datacenter-privileged-api.rs
> --- a/server/src/bin/proxmox-datacenter-privileged-api.rs
> +++ b/server/src/bin/proxmox-datacenter-privileged-api.rs
> @@ -102,6 +102,13 @@ fn create_directories() -> Result<(), Error> {
[...]
> +    pdm_config::setup::mkdir_perms(
> +        api_cache::PDM_API_CACHE_PATH,
> +        api_user.uid,
> +        api_user.gid,
> +        0o755,
> +    )?;

.. the cache root is created with 0o755 here - is that on purpose? With
the current modes any local user can list the cache root and see which
remotes have cached data from the directory names, even though they
cannot read the cached contents. Either drop the root to 0o750 to match,
or add a short comment explaining why the two levels differ.