blob: 45a60e987df9e96310c16a5fbe44de0342d56a74 [file] [log] [blame]
Daniel P. Berrangé55d86982018-05-11 12:19:59 +01001/*
2 * QEMU access control list file authorization driver
3 *
4 * Copyright (c) 2018 Red Hat, Inc.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
Chetan Pant036a80c2020-10-14 13:49:02 +00009 * version 2.1 of the License, or (at your option) any later version.
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010010 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 *
19 */
20
21#include "qemu/osdep.h"
22#include "authz/listfile.h"
Markus Armbruster45b1f682019-03-15 15:51:17 +010023#include "trace.h"
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010024#include "qemu/error-report.h"
25#include "qemu/main-loop.h"
Markus Armbruster0b8fa322019-05-23 16:35:07 +020026#include "qemu/module.h"
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010027#include "qemu/sockets.h"
28#include "qemu/filemonitor.h"
29#include "qom/object_interfaces.h"
30#include "qapi/qapi-visit-authz.h"
31#include "qapi/qmp/qjson.h"
32#include "qapi/qmp/qobject.h"
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010033#include "qapi/qobject-input-visitor.h"
34
35
36static bool
37qauthz_list_file_is_allowed(QAuthZ *authz,
38 const char *identity,
39 Error **errp)
40{
41 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(authz);
42 if (fauthz->list) {
43 return qauthz_is_allowed(fauthz->list, identity, errp);
44 }
45
46 return false;
47}
48
49
50static QAuthZ *
51qauthz_list_file_load(QAuthZListFile *fauthz, Error **errp)
52{
53 GError *err = NULL;
54 gchar *content = NULL;
55 gsize len;
56 QObject *obj = NULL;
57 QDict *pdict;
58 Visitor *v = NULL;
59 QAuthZ *ret = NULL;
60
61 trace_qauthz_list_file_load(fauthz, fauthz->filename);
62 if (!g_file_get_contents(fauthz->filename, &content, &len, &err)) {
63 error_setg(errp, "Unable to read '%s': %s",
64 fauthz->filename, err->message);
65 goto cleanup;
66 }
67
68 obj = qobject_from_json(content, errp);
69 if (!obj) {
70 goto cleanup;
71 }
72
73 pdict = qobject_to(QDict, obj);
74 if (!pdict) {
Markus Armbruster8e26ae72020-11-13 07:23:58 +010075 error_setg(errp, "File '%s' must contain a JSON object",
76 fauthz->filename);
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010077 goto cleanup;
78 }
79
80 v = qobject_input_visitor_new(obj);
81
82 ret = (QAuthZ *)user_creatable_add_type(TYPE_QAUTHZ_LIST,
83 NULL, pdict, v, errp);
84
85 cleanup:
86 visit_free(v);
87 qobject_unref(obj);
88 if (err) {
89 g_error_free(err);
90 }
91 g_free(content);
92 return ret;
93}
94
95
96static void
Daniel P. Berrangéb4682a62019-03-19 15:47:47 +000097qauthz_list_file_event(int64_t wd G_GNUC_UNUSED,
Daniel P. Berrangé55d86982018-05-11 12:19:59 +010098 QFileMonitorEvent ev G_GNUC_UNUSED,
99 const char *name G_GNUC_UNUSED,
100 void *opaque)
101{
102 QAuthZListFile *fauthz = opaque;
103 Error *err = NULL;
104
105 if (ev != QFILE_MONITOR_EVENT_MODIFIED &&
106 ev != QFILE_MONITOR_EVENT_CREATED) {
107 return;
108 }
109
110 object_unref(OBJECT(fauthz->list));
111 fauthz->list = qauthz_list_file_load(fauthz, &err);
112 trace_qauthz_list_file_refresh(fauthz,
113 fauthz->filename, fauthz->list ? 1 : 0);
114 if (!fauthz->list) {
115 error_report_err(err);
116 }
117}
118
119static void
120qauthz_list_file_complete(UserCreatable *uc, Error **errp)
121{
122 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(uc);
123 gchar *dir = NULL, *file = NULL;
124
Eduardo Habkost14b39482020-10-08 16:27:11 -0400125 if (!fauthz->filename) {
126 error_setg(errp, "filename not provided");
127 return;
128 }
129
Daniel P. Berrangé55d86982018-05-11 12:19:59 +0100130 fauthz->list = qauthz_list_file_load(fauthz, errp);
Markus Armbruster2b37e9f2020-11-13 07:23:57 +0100131 if (!fauthz->list) {
132 return;
133 }
Daniel P. Berrangé55d86982018-05-11 12:19:59 +0100134
135 if (!fauthz->refresh) {
136 return;
137 }
138
139 fauthz->file_monitor = qemu_file_monitor_new(errp);
140 if (!fauthz->file_monitor) {
141 return;
142 }
143
144 dir = g_path_get_dirname(fauthz->filename);
145 if (g_str_equal(dir, ".")) {
146 error_setg(errp, "Filename must be an absolute path");
147 goto cleanup;
148 }
149 file = g_path_get_basename(fauthz->filename);
150 if (g_str_equal(file, ".")) {
151 error_setg(errp, "Path has no trailing filename component");
152 goto cleanup;
153 }
154
155 fauthz->file_watch = qemu_file_monitor_add_watch(
156 fauthz->file_monitor, dir, file,
157 qauthz_list_file_event, fauthz, errp);
158 if (fauthz->file_watch < 0) {
159 goto cleanup;
160 }
161
162 cleanup:
163 g_free(file);
164 g_free(dir);
165}
166
167
168static void
169qauthz_list_file_prop_set_filename(Object *obj,
170 const char *value,
171 Error **errp G_GNUC_UNUSED)
172{
173 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
174
175 g_free(fauthz->filename);
176 fauthz->filename = g_strdup(value);
177}
178
179
180static char *
181qauthz_list_file_prop_get_filename(Object *obj,
182 Error **errp G_GNUC_UNUSED)
183{
184 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
185
186 return g_strdup(fauthz->filename);
187}
188
189
190static void
191qauthz_list_file_prop_set_refresh(Object *obj,
192 bool value,
193 Error **errp G_GNUC_UNUSED)
194{
195 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
196
197 fauthz->refresh = value;
198}
199
200
201static bool
202qauthz_list_file_prop_get_refresh(Object *obj,
203 Error **errp G_GNUC_UNUSED)
204{
205 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
206
207 return fauthz->refresh;
208}
209
210
211static void
212qauthz_list_file_finalize(Object *obj)
213{
214 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
215
216 object_unref(OBJECT(fauthz->list));
217 g_free(fauthz->filename);
218 qemu_file_monitor_free(fauthz->file_monitor);
219}
220
221
222static void
223qauthz_list_file_class_init(ObjectClass *oc, void *data)
224{
225 UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
226 QAuthZClass *authz = QAUTHZ_CLASS(oc);
227
228 ucc->complete = qauthz_list_file_complete;
229
230 object_class_property_add_str(oc, "filename",
231 qauthz_list_file_prop_get_filename,
Markus Armbrusterd2623122020-05-05 17:29:22 +0200232 qauthz_list_file_prop_set_filename);
Daniel P. Berrangé55d86982018-05-11 12:19:59 +0100233 object_class_property_add_bool(oc, "refresh",
234 qauthz_list_file_prop_get_refresh,
Markus Armbrusterd2623122020-05-05 17:29:22 +0200235 qauthz_list_file_prop_set_refresh);
Daniel P. Berrangé55d86982018-05-11 12:19:59 +0100236
237 authz->is_allowed = qauthz_list_file_is_allowed;
238}
239
240
241static void
242qauthz_list_file_init(Object *obj)
243{
244 QAuthZListFile *authz = QAUTHZ_LIST_FILE(obj);
245
246 authz->file_watch = -1;
247#ifdef CONFIG_INOTIFY1
Jafar Abdi834e8bf2019-03-23 17:26:34 +0300248 authz->refresh = true;
Daniel P. Berrangé55d86982018-05-11 12:19:59 +0100249#endif
250}
251
252
253QAuthZListFile *qauthz_list_file_new(const char *id,
254 const char *filename,
255 bool refresh,
256 Error **errp)
257{
258 return QAUTHZ_LIST_FILE(
259 object_new_with_props(TYPE_QAUTHZ_LIST_FILE,
260 object_get_objects_root(),
261 id, errp,
262 "filename", filename,
263 "refresh", refresh ? "yes" : "no",
264 NULL));
265}
266
267
268static const TypeInfo qauthz_list_file_info = {
269 .parent = TYPE_QAUTHZ,
270 .name = TYPE_QAUTHZ_LIST_FILE,
271 .instance_init = qauthz_list_file_init,
272 .instance_size = sizeof(QAuthZListFile),
273 .instance_finalize = qauthz_list_file_finalize,
Daniel P. Berrangé55d86982018-05-11 12:19:59 +0100274 .class_init = qauthz_list_file_class_init,
275 .interfaces = (InterfaceInfo[]) {
276 { TYPE_USER_CREATABLE },
277 { }
278 }
279};
280
281
282static void
283qauthz_list_file_register_types(void)
284{
285 type_register_static(&qauthz_list_file_info);
286}
287
288
289type_init(qauthz_list_file_register_types);