From c8c99887d119197e9f670e786db5b045c0470542 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Wed, 21 Oct 2015 14:54:59 +0100 Subject: authz: add QAuthZList object type for an access control list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a QAuthZList object type that implements the QAuthZ interface. This built-in implementation maintains a trivial access control list with a sequence of match rules and a final default policy. This replicates the functionality currently provided by the qemu_acl module. To create an instance of this object via the QMP monitor, the syntax used would be: { "execute": "object-add", "arguments": { "qom-type": "authz-list", "id": "authz0", "props": { "rules": [ { "match": "fred", "policy": "allow", "format": "exact" }, { "match": "bob", "policy": "allow", "format": "exact" }, { "match": "danb", "policy": "deny", "format": "glob" }, { "match": "dan*", "policy": "allow", "format": "exact" }, ], "policy": "deny" } } } This sets up an authorization rule that allows 'fred', 'bob' and anyone whose name starts with 'dan', except for 'danb'. Everyone unmatched is denied. It is not currently possible to create this via -object, since there is no syntax supported to specify non-scalar properties for objects. This is likely to be addressed by later support for using JSON with -object, or an equivalent approach. In any case the future "authz-listfile" object can be used from the CLI and is likely a better choice, as it allows the ACL to be refreshed automatically on change. Reviewed-by: Marc-André Lureau Reviewed-by: Philippe Mathieu-Daudé Tested-by: Philippe Mathieu-Daudé Signed-off-by: Daniel P. Berrange --- qapi/Makefile.objs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'qapi/Makefile.objs') diff --git a/qapi/Makefile.objs b/qapi/Makefile.objs index 87e4df1..77acca0 100644 --- a/qapi/Makefile.objs +++ b/qapi/Makefile.objs @@ -5,7 +5,7 @@ util-obj-y += opts-visitor.o qapi-clone-visitor.o util-obj-y += qmp-event.o util-obj-y += qapi-util.o -QAPI_COMMON_MODULES = block-core block char common crypto introspect +QAPI_COMMON_MODULES = authz block-core block char common crypto introspect QAPI_COMMON_MODULES += job migration misc net rdma rocker run-state QAPI_COMMON_MODULES += sockets tpm trace transaction ui QAPI_TARGET_MODULES = target -- cgit v1.1