[pve-devel] hosts.fw and security groups

[Dietmar Maurer]

> >>Though a bit more about that, and realized that groups.fw is shared
> among all cluster nodes.
> >>
> >>That basically means that the host firewall (node local) is not
> >>updated automatically if the user updates groups.fw (only works for one
> node).
> >>
> >>So this produces unexpected behavior. What do you think about that?
> 
> same for tap interface I think.

Oh, you are right :-(

> Maybe using inotify to update firewall rules on groups.fw file update ?

INotify does not work with the cluster file system (/etc/pve).

But we can implement some kind of polling (inside pvestatd).