Re: [PATCH datacenter-manager 2/4] add api_cache as a specialized wrapper around the namespaced cache

["Lukas Wagner" <l.wagner@proxmox.com>]

On Fri May 15, 2026 at 11:06 AM CEST, Thomas Lamprecht wrote:
> On Wed, 13 May 2026 15:54:55 +0200, Lukas Wagner wrote:
>> diff --git a/server/src/api_cache.rs b/server/src/api_cache.rs
>> new file mode 100644
>> --- /dev/null
>> +++ b/server/src/api_cache.rs
>> @@ -0,0 +1,126 @@
> [...]
>> +const GLOBAL_NAMESPACE: &str = "global";
>> +const LOCK_TIMEOUT: Duration = Duration::from_secs(10);
>> +
>> +static CACHE: LazyLock<NamespacedCache> = LazyLock::new(|| {
>> +    let file_options = proxmox_product_config::default_create_options();
>> +    let dir_options = file_options.perm(Mode::from_bits_truncate(0o750));
>
> w.r.t. 0o750 mode for per-namespace subdirectories here and ...
>
>> +
>> +    NamespacedCache::new(PathBuf::from(PDM_API_CACHE_PATH), dir_options, file_options)
>> +});
>
>> diff --git a/server/src/bin/proxmox-datacenter-privileged-api.rs b/server/src/bin/proxmox-datacenter-privileged-api.rs
>> --- a/server/src/bin/proxmox-datacenter-privileged-api.rs
>> +++ b/server/src/bin/proxmox-datacenter-privileged-api.rs
>> @@ -102,6 +102,13 @@ fn create_directories() -> Result<(), Error> {
> [...]
>> +    pdm_config::setup::mkdir_perms(
>> +        api_cache::PDM_API_CACHE_PATH,
>> +        api_user.uid,
>> +        api_user.gid,
>> +        0o755,
>> +    )?;
>
> .. the cache root is created with 0o755 here - is that on purpose? With
> the current modes any local user can list the cache root and see which
> remotes have cached data from the directory names, even though they
> cannot read the cached contents. Either drop the root to 0o750 to match,
> or add a short comment explaining why the two levels differ.

Good catch! This was a copy-paste mistake, the mkdir_perms call was
copied from from a section above. will be fixed for the next revision,
I'll change it to 0o750.

Thanks!