aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 1 | /* |
| 2 | * QEMU access control list management |
| 3 | * |
| 4 | * Copyright (C) 2009 Red Hat, Inc |
| 5 | * |
| 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy |
| 7 | * of this software and associated documentation files (the "Software"), to deal |
| 8 | * in the Software without restriction, including without limitation the rights |
| 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
| 10 | * copies of the Software, and to permit persons to whom the Software is |
| 11 | * furnished to do so, subject to the following conditions: |
| 12 | * |
| 13 | * The above copyright notice and this permission notice shall be included in |
| 14 | * all copies or substantial portions of the Software. |
| 15 | * |
| 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
| 19 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN |
| 22 | * THE SOFTWARE. |
| 23 | */ |
| 24 | |
| 25 | |
| 26 | #include "qemu-common.h" |
| 27 | #include "sysemu.h" |
| 28 | #include "acl.h" |
| 29 | |
Juan Quintela | 56ffaf2 | 2009-07-27 16:13:00 +0200 | [diff] [blame] | 30 | #ifdef CONFIG_FNMATCH |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 31 | #include <fnmatch.h> |
| 32 | #endif |
| 33 | |
| 34 | |
| 35 | static unsigned int nacls = 0; |
| 36 | static qemu_acl **acls = NULL; |
| 37 | |
| 38 | |
| 39 | |
| 40 | qemu_acl *qemu_acl_find(const char *aclname) |
| 41 | { |
| 42 | int i; |
| 43 | for (i = 0 ; i < nacls ; i++) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 44 | if (strcmp(acls[i]->aclname, aclname) == 0) |
| 45 | return acls[i]; |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 46 | } |
| 47 | |
| 48 | return NULL; |
| 49 | } |
| 50 | |
| 51 | qemu_acl *qemu_acl_init(const char *aclname) |
| 52 | { |
| 53 | qemu_acl *acl; |
| 54 | |
| 55 | acl = qemu_acl_find(aclname); |
| 56 | if (acl) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 57 | return acl; |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 58 | |
| 59 | acl = qemu_malloc(sizeof(*acl)); |
| 60 | acl->aclname = qemu_strdup(aclname); |
| 61 | /* Deny by default, so there is no window of "open |
| 62 | * access" between QEMU starting, and the user setting |
| 63 | * up ACLs in the monitor */ |
| 64 | acl->defaultDeny = 1; |
| 65 | |
| 66 | acl->nentries = 0; |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 67 | QTAILQ_INIT(&acl->entries); |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 68 | |
| 69 | acls = qemu_realloc(acls, sizeof(*acls) * (nacls +1)); |
| 70 | acls[nacls] = acl; |
| 71 | nacls++; |
| 72 | |
| 73 | return acl; |
| 74 | } |
| 75 | |
| 76 | int qemu_acl_party_is_allowed(qemu_acl *acl, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 77 | const char *party) |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 78 | { |
| 79 | qemu_acl_entry *entry; |
| 80 | |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 81 | QTAILQ_FOREACH(entry, &acl->entries, next) { |
Juan Quintela | 56ffaf2 | 2009-07-27 16:13:00 +0200 | [diff] [blame] | 82 | #ifdef CONFIG_FNMATCH |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 83 | if (fnmatch(entry->match, party, 0) == 0) |
| 84 | return entry->deny ? 0 : 1; |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 85 | #else |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 86 | /* No fnmatch, so fallback to exact string matching |
| 87 | * instead of allowing wildcards */ |
| 88 | if (strcmp(entry->match, party) == 0) |
| 89 | return entry->deny ? 0 : 1; |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 90 | #endif |
| 91 | } |
| 92 | |
| 93 | return acl->defaultDeny ? 0 : 1; |
| 94 | } |
| 95 | |
| 96 | |
| 97 | void qemu_acl_reset(qemu_acl *acl) |
| 98 | { |
| 99 | qemu_acl_entry *entry; |
| 100 | |
| 101 | /* Put back to deny by default, so there is no window |
| 102 | * of "open access" while the user re-initializes the |
| 103 | * access control list */ |
| 104 | acl->defaultDeny = 1; |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 105 | QTAILQ_FOREACH(entry, &acl->entries, next) { |
| 106 | QTAILQ_REMOVE(&acl->entries, entry, next); |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 107 | free(entry->match); |
| 108 | free(entry); |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 109 | } |
| 110 | acl->nentries = 0; |
| 111 | } |
| 112 | |
| 113 | |
| 114 | int qemu_acl_append(qemu_acl *acl, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 115 | int deny, |
| 116 | const char *match) |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 117 | { |
| 118 | qemu_acl_entry *entry; |
| 119 | |
| 120 | entry = qemu_malloc(sizeof(*entry)); |
| 121 | entry->match = qemu_strdup(match); |
| 122 | entry->deny = deny; |
| 123 | |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 124 | QTAILQ_INSERT_TAIL(&acl->entries, entry, next); |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 125 | acl->nentries++; |
| 126 | |
| 127 | return acl->nentries; |
| 128 | } |
| 129 | |
| 130 | |
| 131 | int qemu_acl_insert(qemu_acl *acl, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 132 | int deny, |
| 133 | const char *match, |
| 134 | int index) |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 135 | { |
| 136 | qemu_acl_entry *entry; |
| 137 | qemu_acl_entry *tmp; |
| 138 | int i = 0; |
| 139 | |
| 140 | if (index <= 0) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 141 | return -1; |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 142 | if (index >= acl->nentries) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 143 | return qemu_acl_append(acl, deny, match); |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 144 | |
| 145 | |
| 146 | entry = qemu_malloc(sizeof(*entry)); |
| 147 | entry->match = qemu_strdup(match); |
| 148 | entry->deny = deny; |
| 149 | |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 150 | QTAILQ_FOREACH(tmp, &acl->entries, next) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 151 | i++; |
| 152 | if (i == index) { |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 153 | QTAILQ_INSERT_BEFORE(tmp, entry, next); |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 154 | acl->nentries++; |
| 155 | break; |
| 156 | } |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 157 | } |
| 158 | |
| 159 | return i; |
| 160 | } |
| 161 | |
| 162 | int qemu_acl_remove(qemu_acl *acl, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 163 | const char *match) |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 164 | { |
| 165 | qemu_acl_entry *entry; |
| 166 | int i = 0; |
| 167 | |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 168 | QTAILQ_FOREACH(entry, &acl->entries, next) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 169 | i++; |
| 170 | if (strcmp(entry->match, match) == 0) { |
Blue Swirl | 72cf2d4 | 2009-09-12 07:36:22 +0000 | [diff] [blame] | 171 | QTAILQ_REMOVE(&acl->entries, entry, next); |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 172 | return i; |
| 173 | } |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 174 | } |
| 175 | return -1; |
| 176 | } |
| 177 | |
| 178 | |
| 179 | /* |
| 180 | * Local variables: |
| 181 | * c-indent-level: 4 |
| 182 | * c-basic-offset: 4 |
| 183 | * tab-width: 8 |
| 184 | * End: |
| 185 | */ |