blob: 0b7fe721984bb86e571f71c5c17bbfdace26dc73 [file] [log] [blame]
Daniel P. Berrangé55d86982018-05-11 12:19:59 +01001/*
2 * QEMU list file authorization driver
3 *
4 * Copyright (c) 2018 Red Hat, Inc.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
Chetan Pant036a80c2020-10-14 13:49:02 +00009 * version 2.1 of the License, or (at your option) any later version.
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010010 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 *
19 */
20
Markus Armbruster58ea30f2019-03-15 15:51:20 +010021#ifndef QAUTHZ_LISTFILE_H
22#define QAUTHZ_LISTFILE_H
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010023
24#include "authz/list.h"
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010025#include "qemu/filemonitor.h"
Eduardo Habkostdb1015e2020-09-03 16:43:22 -040026#include "qom/object.h"
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010027
28#define TYPE_QAUTHZ_LIST_FILE "authz-list-file"
29
Eduardo Habkost30b57072020-09-16 14:25:17 -040030OBJECT_DECLARE_SIMPLE_TYPE(QAuthZListFile,
Eduardo Habkostc734cd42020-09-16 14:25:16 -040031 QAUTHZ_LIST_FILE)
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010032
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010033
34
35/**
36 * QAuthZListFile:
37 *
38 * This authorization driver provides a file mechanism
39 * for granting access by matching user names against a
40 * file of globs. Each match rule has an associated policy
41 * and a catch all policy applies if no rule matches
42 *
43 * To create an instance of this class via QMP:
44 *
45 * {
46 * "execute": "object-add",
47 * "arguments": {
48 * "qom-type": "authz-list-file",
49 * "id": "authz0",
50 * "props": {
51 * "filename": "/etc/qemu/myvm-vnc.acl",
52 * "refresh": true
53 * }
54 * }
55 * }
56 *
57 * If 'refresh' is 'yes', inotify is used to monitor for changes
58 * to the file and auto-reload the rules.
59 *
60 * The myvm-vnc.acl file should contain the parameters for
61 * the QAuthZList object in JSON format:
62 *
63 * {
64 * "rules": [
65 * { "match": "fred", "policy": "allow", "format": "exact" },
66 * { "match": "bob", "policy": "allow", "format": "exact" },
67 * { "match": "danb", "policy": "deny", "format": "exact" },
68 * { "match": "dan*", "policy": "allow", "format": "glob" }
69 * ],
70 * "policy": "deny"
71 * }
72 *
73 * The object can be created on the command line using
74 *
75 * -object authz-list-file,id=authz0,\
Daniel P. Berrangé4d7beea2020-11-04 13:57:21 +000076 * filename=/etc/qemu/myvm-vnc.acl,refresh=on
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010077 *
78 */
79struct QAuthZListFile {
80 QAuthZ parent_obj;
81
82 QAuthZ *list;
83 char *filename;
84 bool refresh;
85 QFileMonitor *file_monitor;
Daniel P. Berrangéb4682a62019-03-19 15:47:47 +000086 int64_t file_watch;
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010087};
88
89
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010090
91
92QAuthZListFile *qauthz_list_file_new(const char *id,
93 const char *filename,
94 bool refresh,
95 Error **errp);
96
Markus Armbruster58ea30f2019-03-15 15:51:20 +010097#endif /* QAUTHZ_LISTFILE_H */