On Fri, Oct 19, 2018 at 11:33:06AM +0200, Philippe Mathieu-Daudé wrote:
> Hi Daniel,
>
> On 09/10/2018 15:04, Daniel P. Berrangé wrote:
> > From: "Daniel P. Berrange" <berra...@redhat.com>
> >
> > Add a QAuthZList object type that implements the QAuthZ interface. This
> > built-in implementation maintains a trivial access control list with a
> > sequence of match rules and a final default policy. This replicates the
> > functionality currently provided by the qemu_acl module.
> >
> > To create an instance of this object via the QMP monitor, the syntax
> > used would be:
> >
> > {
> > "execute": "object-add",
> > "arguments": {
> > "qom-type": "authz-list",
> > "id": "authz0",
> > "parameters": {
> > "rules": [
> > { "match": "fred", "policy": "allow", "format": "exact" },
> > { "match": "bob", "policy": "allow", "format": "exact" },
> > { "match": "danb", "policy": "deny", "format": "glob" },
> > { "match": "dan*", "policy": "allow", "format": "exact" },
> > ],
> > "policy": "deny"
> > }
> > }
> > }
> >
> > This sets up an authorization rule that allows 'fred', 'bob' and anyone
> > whose name starts with 'dan', except for 'danb'. Everyone unmatched is
> > denied.
> >
> > It is not currently possible to create this via -object, since there is
> > no syntax supported to specify non-scalar properties for objects. This
> > is likely to be addressed by later support for using JSON with -object,
> > or an equivalent approach.
> >
> > In any case the future "authz-listfile" object can be used from the
> > CLI and is likely a better choice, as it allows the ACL to be refreshed
> > automatically on change.
> >
> > Signed-off-by: Daniel P. Berrange <berra...@redhat.com>
> > ---
> > .gitignore | 4 +
> > MAINTAINERS | 1 +
> > Makefile | 7 +-
> > Makefile.objs | 4 +
> > authz/Makefile.objs | 1 +
> > authz/list.c | 315 ++++++++++++++++++++++++++++++++++++++++
> > authz/trace-events | 4 +
> > include/authz/list.h | 106 ++++++++++++++
> > +static void
> > +qauthz_list_complete(UserCreatable *uc, Error **errp)
> > +{
>
> Is this useful?
>
> > +}
No, and it seems we can omit it safely. Same for the previous
patch in this series in fact.
> > +
> > +
> > +static void
> > +qauthz_list_finalize(Object *obj)
> > +{
>
> Ditto.
Opps, it should be freeing the 'rules' field.
> > +ssize_t qauthz_list_append_rule(QAuthZList *auth,
> > + const char *match,
> > + QAuthZListPolicy policy,
> > + QAuthZListFormat format,
> > + Error **errp)
> > +{
> > + QAuthZListRule *rule;
> > + QAuthZListRuleList *rules, *tmp;
> > + size_t i = 0;
> > +
> > +#ifndef CONFIG_FNMATCH
> > + if (format == QAUTHZ_LIST_FORMAT_GLOB) {
> > + error_setg(errp, "Glob format not supported on this platform");
> > + return -1;
> > + }
> > +#endif
> > +
> > + rule = g_new0(QAuthZListRule, 1);
> > + rule->policy = policy;
> > + rule->match = g_strdup(match);
> > + rule->format = format;
> > + rule->has_format = true;
> > +
> > + tmp = g_new0(QAuthZListRuleList, 1);
> > + tmp->value = rule;
> > +
> > + rules = auth->rules;
> > + if (rules) {
> > + while (rules->next) {
> > + i++;
> > + rules = rules->next;
> > + }
> > + rules->next = tmp;
> > + return i + 1;
> > + } else {
> > + auth->rules = tmp;
> > + return 0;
> > + }
>
> Can we manage the rules with the QSLIST macros?
Those macros require specific struct field names, and the
QAuthZListRuleList struct is auto-generated from QAPI so
lacking these fields.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
