Skip to content
  • Daniel P. Berrangé's avatar
    55d86984
    authz: add QAuthZListFile object type for a file access control list · 55d86984
    Daniel P. Berrangé authored
    
    
    Add a QAuthZListFile object type that implements the QAuthZ interface. This
    built-in implementation is a proxy around the QAuthZList object type,
    initializing it from an external file, and optionally, automatically
    reloading it whenever it changes.
    
    To create an instance of this object via the QMP monitor, the syntax
    used would be:
    
          {
            "execute": "object-add",
            "arguments": {
              "qom-type": "authz-list-file",
              "id": "authz0",
              "props": {
                "filename": "/etc/qemu/vnc.acl",
    	    "refresh": true
              }
            }
          }
    
    If "refresh" is "yes", inotify is used to monitor the file,
    automatically reloading changes. If an error occurs during reloading,
    all authorizations will fail until the file is next successfully
    loaded.
    
    The /etc/qemu/vnc.acl file would contain a JSON representation of a
    QAuthZList object
    
        {
          "rules": [
             { "match": "fred", "policy": "allow", "format": "exact" },
             { "match": "bob", "policy": "allow", "format": "exact" },
             { "match": "danb", "policy": "deny", "format": "glob" },
             { "match": "dan*", "policy": "allow", "format": "exact" },
          ],
          "policy": "deny"
        }
    
    This sets up an authorization rule that allows 'fred', 'bob' and anyone
    whose name starts with 'dan', except for 'danb'. Everyone unmatched is
    denied.
    
    The object can be loaded on the comand line using
    
       -object authz-list-file,id=authz0,filename=/etc/qemu/vnc.acl,refresh=yes
    
    Reviewed-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
    Tested-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
    Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    55d86984
    authz: add QAuthZListFile object type for a file access control list
    Daniel P. Berrangé authored
    
    
    Add a QAuthZListFile object type that implements the QAuthZ interface. This
    built-in implementation is a proxy around the QAuthZList object type,
    initializing it from an external file, and optionally, automatically
    reloading it whenever it changes.
    
    To create an instance of this object via the QMP monitor, the syntax
    used would be:
    
          {
            "execute": "object-add",
            "arguments": {
              "qom-type": "authz-list-file",
              "id": "authz0",
              "props": {
                "filename": "/etc/qemu/vnc.acl",
    	    "refresh": true
              }
            }
          }
    
    If "refresh" is "yes", inotify is used to monitor the file,
    automatically reloading changes. If an error occurs during reloading,
    all authorizations will fail until the file is next successfully
    loaded.
    
    The /etc/qemu/vnc.acl file would contain a JSON representation of a
    QAuthZList object
    
        {
          "rules": [
             { "match": "fred", "policy": "allow", "format": "exact" },
             { "match": "bob", "policy": "allow", "format": "exact" },
             { "match": "danb", "policy": "deny", "format": "glob" },
             { "match": "dan*", "policy": "allow", "format": "exact" },
          ],
          "policy": "deny"
        }
    
    This sets up an authorization rule that allows 'fred', 'bob' and anyone
    whose name starts with 'dan', except for 'danb'. Everyone unmatched is
    denied.
    
    The object can be loaded on the comand line using
    
       -object authz-list-file,id=authz0,filename=/etc/qemu/vnc.acl,refresh=yes
    
    Reviewed-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
    Tested-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
    Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
Loading