aboutsummaryrefslogtreecommitdiff
path: root/qemu-options.hx
diff options
context:
space:
mode:
authorDaniel P. Berrangé <berrange@redhat.com>2018-05-02 15:40:33 +0100
committerDaniel P. Berrangé <berrange@redhat.com>2019-02-26 15:25:58 +0000
commitfb5c4ebc0872e5f41634aec2f5a2cb5d83aefcd0 (patch)
treef5d26fc069216b70f6e756ce317ab1e4e2219e54 /qemu-options.hx
parent5b76dd132c5346f335a85161dddaae022b47ccf9 (diff)
downloadqemu-fb5c4ebc0872e5f41634aec2f5a2cb5d83aefcd0.zip
qemu-fb5c4ebc0872e5f41634aec2f5a2cb5d83aefcd0.tar.gz
qemu-fb5c4ebc0872e5f41634aec2f5a2cb5d83aefcd0.tar.bz2
authz: add QAuthZSimple object type for easy whitelist auth checks
In many cases a single VM will just need to whitelist a single identity as the allowed user of network services. This is especially the case for TLS live migration (optionally with NBD storage) where we just need to whitelist the x509 certificate distinguished name of the source QEMU host. Via QMP this can be configured with: { "execute": "object-add", "arguments": { "qom-type": "authz-simple", "id": "authz0", "props": { "identity": "fred" } } } Or via the command line -object authz-simple,id=authz0,identity=fred Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Diffstat (limited to 'qemu-options.hx')
-rw-r--r--qemu-options.hx24
1 files changed, 24 insertions, 0 deletions
diff --git a/qemu-options.hx b/qemu-options.hx
index c843126..6d93447 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4365,6 +4365,30 @@ e.g to launch a SEV guest
.....
@end example
+
+
+@item -object authz-simple,id=@var{id},identity=@var{string}
+
+Create an authorization object that will control access to network services.
+
+The @option{identity} parameter is identifies the user and its format
+depends on the network service that authorization object is associated
+with. For authorizing based on TLS x509 certificates, the identity must
+be the x509 distinguished name. Note that care must be taken to escape
+any commas in the distinguished name.
+
+An example authorization object to validate a x509 distinguished name
+would look like:
+@example
+ # $QEMU \
+ ...
+ -object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,O=Example Org,,L=London,,ST=London,,C=GB' \
+ ...
+@end example
+
+Note the use of quotes due to the x509 distinguished name containing
+whitespace, and escaping of ','.
+
@end table
ETEXI