Bug 783911

Summary:	RFE - create a "read-only" agent
Product:	[Other] RHQ Project	Reporter:	vlad crc <vlad.craciunoiu>
Component:	Agent	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	4.2	CC:	hrupp, mulderika
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description vlad crc 2012-01-23 08:35:24 UTC

We propose to create the possibility to disable those parts of the agent which can do changes on the monitored platform. This is for preventing possible security issues.

See the discussion here:
https://community.jboss.org/message/647797#647797

Best regards,
Vlad Craciunoiu

Comment 1 Mike Foley 2012-01-23 16:17:22 UTC

per scrum 1/23/2012 crouch, loleary, mfoley

Comment 2 Costel C 2012-03-01 14:42:13 UTC

Hi, 

It seems a good idea to have a "read-only" agent.

The proposed solution (to disable the "write" features like Configuration and Provisioning and leave only "read" features like Monitoring) still has an issue: malicious code can be embedded in the monitoring part of the plugins. 

An idea would be to sign the plugin JAR. The agent will check the signature every time a plugin update is performed. The signature will guarantee that the plugins come only from a trusted source.

What do you think about this idea ?

Regards,
Costel