qemu/qapi
Daniel P. Berrange c8c99887d1 authz: add QAuthZList object type for an access control list
Add a QAuthZList object type that implements the QAuthZ interface. This
built-in implementation maintains a trivial access control list with a
sequence of match rules and a final default policy. This replicates the
functionality currently provided by the qemu_acl module.

To create an instance of this object via the QMP monitor, the syntax
used would be:

  {
    "execute": "object-add",
    "arguments": {
      "qom-type": "authz-list",
      "id": "authz0",
      "props": {
        "rules": [
           { "match": "fred", "policy": "allow", "format": "exact" },
           { "match": "bob", "policy": "allow", "format": "exact" },
           { "match": "danb", "policy": "deny", "format": "glob" },
           { "match": "dan*", "policy": "allow", "format": "exact" },
        ],
        "policy": "deny"
      }
    }
  }

This sets up an authorization rule that allows 'fred', 'bob' and anyone
whose name starts with 'dan', except for 'danb'. Everyone unmatched is
denied.

It is not currently possible to create this via -object, since there is
no syntax supported to specify non-scalar properties for objects. This
is likely to be addressed by later support for using JSON with -object,
or an equivalent approach.

In any case the future "authz-listfile" object can be used from the
CLI and is likely a better choice, as it allows the ACL to be refreshed
automatically on change.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2019-02-26 15:32:18 +00:00
..
authz.json authz: add QAuthZList object type for an access control list 2019-02-26 15:32:18 +00:00
block-core.json block/dirty-bitmap: Documentation and Comment fixups 2019-02-19 17:49:43 -05:00
block.json nbd: Remove x-nbd-server-add-bitmap 2019-01-14 10:09:46 -06:00
char.json qapi: add more conditions to SPICE 2018-12-14 06:52:48 +01:00
common.json qapi: Define PCIe link speed and width properties 2018-12-19 16:48:16 -05:00
crypto.json crypto: Fix defaults in QCryptoBlockCreateOptionsLUKS 2018-12-12 11:16:49 +00:00
introspect.json json: Update references to RFC 7159 to RFC 8259 2018-08-24 20:27:14 +02:00
job.json qapi/job: The next release will be 3.0 2018-06-29 14:20:56 +02:00
Makefile.objs authz: add QAuthZList object type for an access control list 2019-02-26 15:32:18 +00:00
migration.json migration: introduce pages-per-second 2019-01-23 15:51:47 +00:00
misc.json qapi: move RTC_CHANGE to the target schema 2019-02-18 14:44:05 +01:00
net.json qapi: break long lines at 'data' member 2018-12-13 19:20:11 +01:00
opts-visitor.c qapi: Fix QemuOpts visitor regression on unvisited input 2017-03-22 19:24:34 +01:00
qapi-clone-visitor.c qapi/qnull: Add own header 2017-11-17 18:21:30 +01:00
qapi-dealloc-visitor.c qobject: Replace qobject_incref/QINCREF qobject_decref/QDECREF 2018-05-04 08:27:53 +02:00
qapi-schema.json authz: add QAuthZList object type for an access control list 2019-02-26 15:32:18 +00:00
qapi-util.c qapi: Change data type of the FOO_lookup generated for enum FOO 2017-09-04 13:09:13 +02:00
qapi-visit-core.c Include qapi/qmp/qobject.h exactly where needed 2018-02-09 13:52:15 +01:00
qmp-dispatch.c qmp: constify qmp_is_oob() 2018-08-30 16:08:47 +02:00
qmp-event.c qapi: Eliminate indirection through qmp_event_get_func_emit() 2019-01-24 10:01:05 +01:00
qmp-registry.c qapi: remove qmp_unregister_command() 2019-02-18 14:44:05 +01:00
qobject-input-visitor.c qapi: Use qemu_strtod_finite() in qobject-input-visitor 2018-12-13 19:10:06 +01:00
qobject-output-visitor.c qobject: Modify qobject_ref() to return obj 2018-05-04 08:27:53 +02:00
rdma.json qapi: Define new QMP message for pvrdma 2018-12-22 11:09:56 +02:00
rocker.json qapi: The #optional tag is redundant, drop 2017-03-16 07:13:02 +01:00
run-state.json qmp: Split ShutdownCause host-qmp into quit and system-reset 2018-12-18 07:55:47 +01:00
sockets.json sockets: allow SocketAddress 'fd' to reference numeric file descriptors 2018-03-13 18:06:06 +00:00
string-input-visitor.c qapi: Rewrite string-input-visitor's integer and list parsing 2018-12-13 19:10:06 +01:00
string-output-visitor.c qapi: Use QNull for a more regular visit_type_null() 2017-07-24 13:35:11 +02:00
target.json target/mips: implement QMP query-cpu-definitions command 2019-02-21 19:36:47 +01:00
tpm.json qapi: break long lines at 'data' member 2018-12-13 19:20:11 +01:00
trace-events trace: forbid floating point types 2018-06-27 11:09:29 +01:00
trace.json qapi-schema: Improve section headings 2017-09-04 13:09:12 +02:00
transaction.json block: remove 'x' prefix from experimental bitmap APIs 2019-01-14 10:09:46 -06:00
ui.json display: add -display spice-app launching a Spice client 2019-02-22 07:42:59 +01:00