Re: [Qemu-devel] [PATCH v6 08/11] authz: add QAuthZList object type for an access control list
On Thu, Nov 08, 2018 at 02:23:43AM +0400, Marc-André Lureau wrote:
> Hi
>
> On Fri, Oct 19, 2018 at 5:45 PM Daniel P. Berrangé wrote
> > ---
> > Makefile| 7 +-
> > Makefile.objs | 4 +
> > qapi/authz.json | 58
> > qapi/qapi-schema.json | 1 +
> > include/authz/list.h| 106 ++
> > authz/list.c| 309
> > tests/test-authz-list.c | 171 ++
> > .gitignore | 4 +
> > MAINTAINERS | 1 +
> > authz/Makefile.objs | 1 +
> > authz/trace-events | 4 +
> > tests/Makefile.include | 4 +
> > 12 files changed, 669 insertions(+), 1 deletion(-)
> > create mode 100644 qapi/authz.json
> > create mode 100644 include/authz/list.h
> > create mode 100644 authz/list.c
> > create mode 100644 tests/test-authz-list.c
> >
> > diff --git a/qapi/authz.json b/qapi/authz.json
> > new file mode 100644
> > index 00..607839c627
> > --- /dev/null
> > +++ b/qapi/authz.json
> > @@ -0,0 +1,58 @@
> > +# -*- Mode: Python -*-
> > +#
> > +# QAPI authz definitions
> > +
> > +##
> > +# @QAuthZListPolicy:
> > +#
> > +# The authorization policy result
> > +#
> > +# @deny: deny access
> > +# @allow: allow access
> > +#
> > +# Since: 3.0
>
> obviously, you'll have to update to 3.2
4.0 in fact since we bump at the start of each year
> > +##
> > +# @QAuthZListRuleListHack:
> > +#
> > +# Not exposed via QMP; hack to generate QAuthZListRuleList
> > +# for use internally by the code.
>
> Well, this will probably end in the documentation (it's already in the
> .json, which is one source of documentation ;).
>
> What about adding a 'gen-list' field, or a 'pragma' listing the
> structs that should have list code generated?
I'll leave that for future motivated contributors, as I'm just
following pre-existing best practice here.
> > +static bool qauthz_list_is_allowed(QAuthZ *authz,
> > + const char *identity,
> > + Error **errp)
> > +{
> > +QAuthZList *lauthz = QAUTHZ_LIST(authz);
> > +QAuthZListRuleList *rules = lauthz->rules;
> > +
> > +while (rules) {
> > +QAuthZListRule *rule = rules->value;
> > +QAuthZListFormat format = rule->has_format ? rule->format :
> > +QAUTHZ_LIST_FORMAT_EXACT;
> > +
> > +trace_qauthz_list_check_rule(authz, rule->match, identity,
> > + format, rule->policy);
> > +switch (format) {
> > +case QAUTHZ_LIST_FORMAT_EXACT:
> > +if (strcmp(rule->match, identity) == 0) {
>
> g_str_equal() ?
Yes.
>
> > +return rule->policy == QAUTHZ_LIST_POLICY_ALLOW;
> > +}
> > +break;
> > +#ifdef CONFIG_FNMATCH
> > +case QAUTHZ_LIST_FORMAT_GLOB:
> > +if (fnmatch(rule->match, identity, 0) == 0) {
>
> Would GPatternSpec be a good alternative?
Excellent, I didn't know about it
> > +return rule->policy == QAUTHZ_LIST_POLICY_ALLOW;
> > +}
> > +break;
> > +#else
> > +return false;
> > +#endif
> > +default:
>
>
> No g_warn_if_reached() ?Then perhaps add a comment why.
I guess we could.
> > +ssize_t qauthz_list_delete_rule(QAuthZList *auth, const char *match)
> > +{
> > +QAuthZListRule *rule;
> > +QAuthZListRuleList *rules, *prev;
> > +size_t i = 0;
> > +
> > +prev = NULL;
> > +rules = auth->rules;
> > +while (rules) {
> > +rule = rules->value;
> > +if (g_str_equal(rule->match, match)) {
> > +if (prev) {
> > +prev->next = rules->next;
> > +} else {
> > +auth->rules = rules->next;
> > +}
> > +rules->next = NULL;
> > +qapi_free_QAuthZListRuleList(rules);
> > +return i;
>
> What's the point in returning the old index? Maybe true/false along
> with an Error would be more convenient?
It is required for the conversion of the existing acl_remove API
in the HMP monitor.
Regards,
Daniel
--
|: https://berrange.com -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|
Re: [Qemu-devel] [PATCH v6 08/11] authz: add QAuthZList object type for an access control list
On Fri, Oct 19, 2018 at 5:45 PM Daniel P. Berrangé wrote:
>
> From: "Daniel P. Berrange"
>
> Add a QAuthZList object type that implements the QAuthZ interface. This
> built-in implementation maintains a trivial access control list with a
> sequence of match rules and a final default policy. This replicates the
> functionality currently provided by the qemu_acl module.
>
> To create an instance of this object via the QMP monitor, the syntax
> used would be:
>
> {
> "execute": "object-add",
> "arguments": {
> "qom-type": "authz-list",
> "id": "authz0",
> "parameters": {
> "rules": [
>{ "match": "fred", "policy": "allow", "format": "exact" },
>{ "match": "bob", "policy": "allow", "format": "exact" },
>{ "match": "danb", "policy": "deny", "format": "glob" },
>{ "match": "dan*", "policy": "allow", "format": "exact" },
> ],
> "policy": "deny"
> }
> }
> }
>
> This sets up an authorization rule that allows 'fred', 'bob' and anyone
> whose name starts with 'dan', except for 'danb'. Everyone unmatched is
> denied.
>
> It is not currently possible to create this via -object, since there is
> no syntax supported to specify non-scalar properties for objects. This
> is likely to be addressed by later support for using JSON with -object,
> or an equivalent approach.
>
> In any case the future "authz-listfile" object can be used from the
> CLI and is likely a better choice, as it allows the ACL to be refreshed
> automatically on change.
>
> Signed-off-by: Daniel P. Berrange
> ---
> Makefile| 7 +-
> Makefile.objs | 4 +
> qapi/authz.json | 58
> qapi/qapi-schema.json | 1 +
> include/authz/list.h| 106 ++
> authz/list.c| 309
> tests/test-authz-list.c | 171 ++
> .gitignore | 4 +
> MAINTAINERS | 1 +
> authz/Makefile.objs | 1 +
> authz/trace-events | 4 +
> tests/Makefile.include | 4 +
> 12 files changed, 669 insertions(+), 1 deletion(-)
> create mode 100644 qapi/authz.json
> create mode 100644 include/authz/list.h
> create mode 100644 authz/list.c
> create mode 100644 tests/test-authz-list.c
>
> diff --git a/Makefile b/Makefile
> index 4b20ee2b19..da9ea40725 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -600,7 +600,8 @@ qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json
> $(SRC_PATH)/qapi/common.json \
> $(SRC_PATH)/qapi/tpm.json \
> $(SRC_PATH)/qapi/trace.json \
> $(SRC_PATH)/qapi/transaction.json \
> - $(SRC_PATH)/qapi/ui.json
> + $(SRC_PATH)/qapi/ui.json \
> + $(SRC_PATH)/qapi/authz.json
>
> qapi/qapi-builtin-types.c qapi/qapi-builtin-types.h \
> qapi/qapi-types.c qapi/qapi-types.h \
> @@ -621,6 +622,7 @@ qapi/qapi-types-tpm.c qapi/qapi-types-tpm.h \
> qapi/qapi-types-trace.c qapi/qapi-types-trace.h \
> qapi/qapi-types-transaction.c qapi/qapi-types-transaction.h \
> qapi/qapi-types-ui.c qapi/qapi-types-ui.h \
> +qapi/qapi-types-authz.c qapi/qapi-types-authz.h \
> qapi/qapi-builtin-visit.c qapi/qapi-builtin-visit.h \
> qapi/qapi-visit.c qapi/qapi-visit.h \
> qapi/qapi-visit-block-core.c qapi/qapi-visit-block-core.h \
> @@ -640,6 +642,7 @@ qapi/qapi-visit-tpm.c qapi/qapi-visit-tpm.h \
> qapi/qapi-visit-trace.c qapi/qapi-visit-trace.h \
> qapi/qapi-visit-transaction.c qapi/qapi-visit-transaction.h \
> qapi/qapi-visit-ui.c qapi/qapi-visit-ui.h \
> +qapi/qapi-visit-authz.c qapi/qapi-visit-authz.h \
> qapi/qapi-commands.h qapi/qapi-commands.c \
> qapi/qapi-commands-block-core.c qapi/qapi-commands-block-core.h \
> qapi/qapi-commands-block.c qapi/qapi-commands-block.h \
> @@ -658,6 +661,7 @@ qapi/qapi-commands-tpm.c qapi/qapi-commands-tpm.h \
> qapi/qapi-commands-trace.c qapi/qapi-commands-trace.h \
> qapi/qapi-commands-transaction.c qapi/qapi-commands-transaction.h \
> qapi/qapi-commands-ui.c qapi/qapi-commands-ui.h \
> +qapi/qapi-commands-authz.c qapi/qapi-commands-authz.h \
> qapi/qapi-events.c qapi/qapi-events.h \
> qapi/qapi-events-block-core.c qapi/qapi-events-block-core.h \
> qapi/qapi-events-block.c qapi/qapi-events-block.h \
> @@ -676,6 +680,7 @@ qapi/qapi-events-tpm.c qapi/qapi-events-tpm.h \
> qapi/qapi-events-trace.c qapi/qapi-events-trace.h \
> qapi/qapi-events-transaction.c qapi/qapi-events-transaction.h \
> qapi/qapi-events-ui.c qapi/qapi-events-ui.h \
> +qapi/qapi-events-authz.c qapi/qapi-events-authz.h \
> qapi/qapi-introspect.h qapi/qapi-introspect.c \
> qapi/qapi-doc.texi: \
> qapi-gen-timestamp ;
> diff --git a/Makefile.objs b/Makefile.objs
> index ecb1071c4f..825c5863ac 100644
> --- a/Makefile.objs
> +++ b/Makefile.objs
> @@ -21,6 +21,7 @@ util-obj-y += qapi/qapi-types-tpm.o
> util-obj-y += qapi/qapi-types-trace.o
> util-obj-y += qapi/qapi-types-transaction.o
> util-obj-y +=
Re: [Qemu-devel] [PATCH v6 08/11] authz: add QAuthZList object type for an access control list
On 11/7/18 4:23 PM, Marc-André Lureau wrote: +## +# @QAuthZListRuleListHack: +# +# Not exposed via QMP; hack to generate QAuthZListRuleList +# for use internally by the code. Well, this will probably end in the documentation (it's already in the .json, which is one source of documentation ;). What about adding a 'gen-list' field, or a 'pragma' listing the structs that should have list code generated? We've used this hack several times in the past, but indeed there might be nicer design approaches to consider now that we have pragma listings. But I don't see that as holding up this series. -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3266 Virtualization: qemu.org | libvirt.org
Re: [Qemu-devel] [PATCH v6 08/11] authz: add QAuthZList object type for an access control list
Hi
On Fri, Oct 19, 2018 at 5:45 PM Daniel P. Berrangé wrote:
>
> From: "Daniel P. Berrange"
>
> Add a QAuthZList object type that implements the QAuthZ interface. This
> built-in implementation maintains a trivial access control list with a
> sequence of match rules and a final default policy. This replicates the
> functionality currently provided by the qemu_acl module.
>
> To create an instance of this object via the QMP monitor, the syntax
> used would be:
>
> {
> "execute": "object-add",
> "arguments": {
> "qom-type": "authz-list",
> "id": "authz0",
> "parameters": {
> "rules": [
>{ "match": "fred", "policy": "allow", "format": "exact" },
>{ "match": "bob", "policy": "allow", "format": "exact" },
>{ "match": "danb", "policy": "deny", "format": "glob" },
>{ "match": "dan*", "policy": "allow", "format": "exact" },
> ],
> "policy": "deny"
> }
> }
> }
>
> This sets up an authorization rule that allows 'fred', 'bob' and anyone
> whose name starts with 'dan', except for 'danb'. Everyone unmatched is
> denied.
>
> It is not currently possible to create this via -object, since there is
> no syntax supported to specify non-scalar properties for objects. This
> is likely to be addressed by later support for using JSON with -object,
> or an equivalent approach.
>
> In any case the future "authz-listfile" object can be used from the
> CLI and is likely a better choice, as it allows the ACL to be refreshed
> automatically on change.
>
> Signed-off-by: Daniel P. Berrange
some notes below, but in general:
Reviewed-by: Marc-André Lureau
> ---
> Makefile| 7 +-
> Makefile.objs | 4 +
> qapi/authz.json | 58
> qapi/qapi-schema.json | 1 +
> include/authz/list.h| 106 ++
> authz/list.c| 309
> tests/test-authz-list.c | 171 ++
> .gitignore | 4 +
> MAINTAINERS | 1 +
> authz/Makefile.objs | 1 +
> authz/trace-events | 4 +
> tests/Makefile.include | 4 +
> 12 files changed, 669 insertions(+), 1 deletion(-)
> create mode 100644 qapi/authz.json
> create mode 100644 include/authz/list.h
> create mode 100644 authz/list.c
> create mode 100644 tests/test-authz-list.c
>
> diff --git a/Makefile b/Makefile
> index 4b20ee2b19..da9ea40725 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -600,7 +600,8 @@ qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json
> $(SRC_PATH)/qapi/common.json \
> $(SRC_PATH)/qapi/tpm.json \
> $(SRC_PATH)/qapi/trace.json \
> $(SRC_PATH)/qapi/transaction.json \
> - $(SRC_PATH)/qapi/ui.json
> + $(SRC_PATH)/qapi/ui.json \
> + $(SRC_PATH)/qapi/authz.json
>
> qapi/qapi-builtin-types.c qapi/qapi-builtin-types.h \
> qapi/qapi-types.c qapi/qapi-types.h \
> @@ -621,6 +622,7 @@ qapi/qapi-types-tpm.c qapi/qapi-types-tpm.h \
> qapi/qapi-types-trace.c qapi/qapi-types-trace.h \
> qapi/qapi-types-transaction.c qapi/qapi-types-transaction.h \
> qapi/qapi-types-ui.c qapi/qapi-types-ui.h \
> +qapi/qapi-types-authz.c qapi/qapi-types-authz.h \
> qapi/qapi-builtin-visit.c qapi/qapi-builtin-visit.h \
> qapi/qapi-visit.c qapi/qapi-visit.h \
> qapi/qapi-visit-block-core.c qapi/qapi-visit-block-core.h \
> @@ -640,6 +642,7 @@ qapi/qapi-visit-tpm.c qapi/qapi-visit-tpm.h \
> qapi/qapi-visit-trace.c qapi/qapi-visit-trace.h \
> qapi/qapi-visit-transaction.c qapi/qapi-visit-transaction.h \
> qapi/qapi-visit-ui.c qapi/qapi-visit-ui.h \
> +qapi/qapi-visit-authz.c qapi/qapi-visit-authz.h \
> qapi/qapi-commands.h qapi/qapi-commands.c \
> qapi/qapi-commands-block-core.c qapi/qapi-commands-block-core.h \
> qapi/qapi-commands-block.c qapi/qapi-commands-block.h \
> @@ -658,6 +661,7 @@ qapi/qapi-commands-tpm.c qapi/qapi-commands-tpm.h \
> qapi/qapi-commands-trace.c qapi/qapi-commands-trace.h \
> qapi/qapi-commands-transaction.c qapi/qapi-commands-transaction.h \
> qapi/qapi-commands-ui.c qapi/qapi-commands-ui.h \
> +qapi/qapi-commands-authz.c qapi/qapi-commands-authz.h \
> qapi/qapi-events.c qapi/qapi-events.h \
> qapi/qapi-events-block-core.c qapi/qapi-events-block-core.h \
> qapi/qapi-events-block.c qapi/qapi-events-block.h \
> @@ -676,6 +680,7 @@ qapi/qapi-events-tpm.c qapi/qapi-events-tpm.h \
> qapi/qapi-events-trace.c qapi/qapi-events-trace.h \
> qapi/qapi-events-transaction.c qapi/qapi-events-transaction.h \
> qapi/qapi-events-ui.c qapi/qapi-events-ui.h \
> +qapi/qapi-events-authz.c qapi/qapi-events-authz.h \
> qapi/qapi-introspect.h qapi/qapi-introspect.c \
> qapi/qapi-doc.texi: \
> qapi-gen-timestamp ;
> diff --git a/Makefile.objs b/Makefile.objs
> index ecb1071c4f..825c5863ac 100644
> --- a/Makefile.objs
> +++ b/Makefile.objs
> @@ -21,6 +21,7 @@ util-obj-y += qapi/qapi-types-tpm.o
> util-obj-y += qapi/qapi-types-trace.o
>
Re: [Qemu-devel] [PATCH v6 08/11] authz: add QAuthZList object type for an access control list
On 19/10/18 15:38, Daniel P. Berrangé wrote:
From: "Daniel P. Berrange"
Add a QAuthZList object type that implements the QAuthZ interface. This
built-in implementation maintains a trivial access control list with a
sequence of match rules and a final default policy. This replicates the
functionality currently provided by the qemu_acl module.
To create an instance of this object via the QMP monitor, the syntax
used would be:
{
"execute": "object-add",
"arguments": {
"qom-type": "authz-list",
"id": "authz0",
"parameters": {
"rules": [
{ "match": "fred", "policy": "allow", "format": "exact" },
{ "match": "bob", "policy": "allow", "format": "exact" },
{ "match": "danb", "policy": "deny", "format": "glob" },
{ "match": "dan*", "policy": "allow", "format": "exact" },
],
"policy": "deny"
}
}
}
This sets up an authorization rule that allows 'fred', 'bob' and anyone
whose name starts with 'dan', except for 'danb'. Everyone unmatched is
denied.
It is not currently possible to create this via -object, since there is
no syntax supported to specify non-scalar properties for objects. This
is likely to be addressed by later support for using JSON with -object,
or an equivalent approach.
In any case the future "authz-listfile" object can be used from the
CLI and is likely a better choice, as it allows the ACL to be refreshed
automatically on change.
Signed-off-by: Daniel P. Berrange
Reviewed-by: Philippe Mathieu-Daudé
Tested-by: Philippe Mathieu-Daudé
---
Makefile| 7 +-
Makefile.objs | 4 +
qapi/authz.json | 58
qapi/qapi-schema.json | 1 +
include/authz/list.h| 106 ++
authz/list.c| 309
tests/test-authz-list.c | 171 ++
.gitignore | 4 +
MAINTAINERS | 1 +
authz/Makefile.objs | 1 +
authz/trace-events | 4 +
tests/Makefile.include | 4 +
12 files changed, 669 insertions(+), 1 deletion(-)
create mode 100644 qapi/authz.json
create mode 100644 include/authz/list.h
create mode 100644 authz/list.c
create mode 100644 tests/test-authz-list.c
diff --git a/Makefile b/Makefile
index 4b20ee2b19..da9ea40725 100644
--- a/Makefile
+++ b/Makefile
@@ -600,7 +600,8 @@ qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json
$(SRC_PATH)/qapi/common.json \
$(SRC_PATH)/qapi/tpm.json \
$(SRC_PATH)/qapi/trace.json \
$(SRC_PATH)/qapi/transaction.json \
- $(SRC_PATH)/qapi/ui.json
+ $(SRC_PATH)/qapi/ui.json \
+ $(SRC_PATH)/qapi/authz.json
qapi/qapi-builtin-types.c qapi/qapi-builtin-types.h \
qapi/qapi-types.c qapi/qapi-types.h \
@@ -621,6 +622,7 @@ qapi/qapi-types-tpm.c qapi/qapi-types-tpm.h \
qapi/qapi-types-trace.c qapi/qapi-types-trace.h \
qapi/qapi-types-transaction.c qapi/qapi-types-transaction.h \
qapi/qapi-types-ui.c qapi/qapi-types-ui.h \
+qapi/qapi-types-authz.c qapi/qapi-types-authz.h \
qapi/qapi-builtin-visit.c qapi/qapi-builtin-visit.h \
qapi/qapi-visit.c qapi/qapi-visit.h \
qapi/qapi-visit-block-core.c qapi/qapi-visit-block-core.h \
@@ -640,6 +642,7 @@ qapi/qapi-visit-tpm.c qapi/qapi-visit-tpm.h \
qapi/qapi-visit-trace.c qapi/qapi-visit-trace.h \
qapi/qapi-visit-transaction.c qapi/qapi-visit-transaction.h \
qapi/qapi-visit-ui.c qapi/qapi-visit-ui.h \
+qapi/qapi-visit-authz.c qapi/qapi-visit-authz.h \
qapi/qapi-commands.h qapi/qapi-commands.c \
qapi/qapi-commands-block-core.c qapi/qapi-commands-block-core.h \
qapi/qapi-commands-block.c qapi/qapi-commands-block.h \
@@ -658,6 +661,7 @@ qapi/qapi-commands-tpm.c qapi/qapi-commands-tpm.h \
qapi/qapi-commands-trace.c qapi/qapi-commands-trace.h \
qapi/qapi-commands-transaction.c qapi/qapi-commands-transaction.h \
qapi/qapi-commands-ui.c qapi/qapi-commands-ui.h \
+qapi/qapi-commands-authz.c qapi/qapi-commands-authz.h \
qapi/qapi-events.c qapi/qapi-events.h \
qapi/qapi-events-block-core.c qapi/qapi-events-block-core.h \
qapi/qapi-events-block.c qapi/qapi-events-block.h \
@@ -676,6 +680,7 @@ qapi/qapi-events-tpm.c qapi/qapi-events-tpm.h \
qapi/qapi-events-trace.c qapi/qapi-events-trace.h \
qapi/qapi-events-transaction.c qapi/qapi-events-transaction.h \
qapi/qapi-events-ui.c qapi/qapi-events-ui.h \
+qapi/qapi-events-authz.c qapi/qapi-events-authz.h \
qapi/qapi-introspect.h qapi/qapi-introspect.c \
qapi/qapi-doc.texi: \
qapi-gen-timestamp ;
diff --git a/Makefile.objs b/Makefile.objs
index ecb1071c4f..825c5863ac 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -21,6 +21,7 @@ util-obj-y += qapi/qapi-types-tpm.o
util-obj-y += qapi/qapi-types-trace.o
util-obj-y += qapi/qapi-types-transaction.o
util-obj-y += qapi/qapi-types-ui.o
+util-obj-y += qapi/qapi-types-authz.o
util-obj-y += qapi/qapi-builtin-visit.o
