[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [PATCH v4 00/17] Add authorization support to all netwo
|
From: |
Daniel P . Berrangé |
|
Subject: |
Re: [Qemu-block] [PATCH v4 00/17] Add authorization support to all network services |
|
Date: |
Fri, 15 Feb 2019 17:17:13 +0000 |
|
User-agent: |
Mutt/1.10.1 (2018-07-13) |
mis-fire.
Ignore this one, I used the wrong base branch to git-publish and didn't
interrupt it quickly enough
Re-posted v4 with correct base.
On Fri, Feb 15, 2019 at 05:13:28PM +0000, Daniel P. Berrangé wrote:
> v1: https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg04482.html
> v2: https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg05727.html
> v3: https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg01639.html
>
> This series builds on the core authorization framework:
>
> v8: https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04253.html
>
> enabling its use with the VNC, chardev, NBD and migration network servers.
>
> In combination with TLS x509 client certificates, this allows these
> services to whitelist specific clients, which avoids the need to setup
> restricted child certificate authorities.
>
> In VNC it also allows whitelisting based on SASL user names.
>
> Changed in v4:
>
> - Update deprecation versions to 4.0
> - Rebased to latest git
>
> Changed in v3:
>
> - Rebased to latest git master
>
> Changed in v2:
>
> - Document that authz objects are resolved at time of use, not
> time of network service activation
> - Improve docs for tls-authz parameters on services
> - Fix 2.13 -> 3.0 version tags
> - Remove redundant conditionals around g_strdup
> - Fix arg syntax for qemu-nbd s/-/--/
> - Remove QAPI (optional) annotation
> - Fix some outdated usage example
>
> Based-on: <address@hidden>
>
> Daniel P. Berrangé (17):
> util: add helper APIs for dealing with inotify in portable manner
> qom: don't require user creatable objects to be registered
> hw/usb: don't set IN_ISDIR for inotify watch in MTP driver
> hw/usb: fix const-ness for string params in MTP driver
> hw/usb: switch MTP to use new inotify APIs
> authz: add QAuthZ object as an authorization base class
> authz: add QAuthZSimple object type for easy whitelist auth checks
> authz: add QAuthZList object type for an access control list
> authz: add QAuthZListFile object type for a file access control list
> authz: add QAuthZPAM object type for authorizing using PAM
> authz: delete existing ACL implementation
> qemu-nbd: add support for authorization of TLS clients
> nbd: allow authorization with nbd-server-start QMP command
> migration: add support for a "tls-authz" migration parameter
> chardev: add support for authorization for TLS clients
> vnc: allow specifying a custom authorization object name
> monitor: deprecate acl_show, acl_reset, acl_policy, acl_add,
> acl_remove
>
> MAINTAINERS | 15 +
> Makefile | 10 +-
> Makefile.objs | 10 +-
> Makefile.target | 2 +
> authz/Makefile.objs | 7 +
> authz/base.c | 82 ++++
> authz/list.c | 271 +++++++++++++
> authz/listfile.c | 283 ++++++++++++++
> authz/pamacct.c | 149 +++++++
> authz/simple.c | 115 ++++++
> authz/trace-events | 18 +
> blockdev-nbd.c | 11 +-
> chardev/char-socket.c | 12 +-
> chardev/char.c | 3 +
> configure | 54 ++-
> crypto/tlssession.c | 35 +-
> crypto/trace-events | 2 +-
> hmp.c | 11 +-
> hw/usb/dev-mtp.c | 281 ++++++--------
> hw/usb/trace-events | 2 +-
> include/authz/base.h | 112 ++++++
> include/authz/list.h | 106 +++++
> include/authz/listfile.h | 111 ++++++
> include/authz/pamacct.h | 100 +++++
> include/authz/simple.h | 84 ++++
> include/block/nbd.h | 4 +-
> include/qemu/acl.h | 66 ----
> include/qemu/filemonitor.h | 128 ++++++
> migration/migration.c | 8 +
> migration/tls.c | 2 +-
> monitor.c | 202 +++++++---
> nbd/server.c | 10 +-
> qapi/authz.json | 58 +++
> qapi/block.json | 8 +-
> qapi/char.json | 6 +
> qapi/migration.json | 14 +-
> qapi/qapi-schema.json | 1 +
> qemu-deprecated.texi | 11 +
> qemu-nbd.c | 14 +-
> qemu-nbd.texi | 4 +
> qemu-options.hx | 149 ++++++-
> qom/object.c | 12 +-
> qom/object_interfaces.c | 16 +-
> tests/Makefile.include | 16 +-
> tests/qemu-iotests/233 | 31 +-
> tests/qemu-iotests/233.out | 11 +
> tests/test-authz-list.c | 159 ++++++++
> tests/test-authz-listfile.c | 195 ++++++++++
> tests/test-authz-pam.c | 124 ++++++
> tests/test-authz-simple.c | 50 +++
> tests/test-crypto-tlssession.c | 15 +-
> tests/test-io-channel-tls.c | 16 +-
> tests/test-util-filemonitor.c | 685 +++++++++++++++++++++++++++++++++
> ui/vnc-auth-sasl.c | 23 +-
> ui/vnc-auth-sasl.h | 5 +-
> ui/vnc-auth-vencrypt.c | 2 +-
> ui/vnc-ws.c | 2 +-
> ui/vnc.c | 85 +++-
> ui/vnc.h | 4 +-
> util/Makefile.objs | 4 +-
> util/acl.c | 179 ---------
> util/filemonitor-inotify.c | 338 ++++++++++++++++
> util/filemonitor-stub.c | 59 +++
> util/trace-events | 9 +
> 64 files changed, 4013 insertions(+), 598 deletions(-)
> create mode 100644 authz/Makefile.objs
> create mode 100644 authz/base.c
> create mode 100644 authz/list.c
> create mode 100644 authz/listfile.c
> create mode 100644 authz/pamacct.c
> create mode 100644 authz/simple.c
> create mode 100644 authz/trace-events
> create mode 100644 include/authz/base.h
> create mode 100644 include/authz/list.h
> create mode 100644 include/authz/listfile.h
> create mode 100644 include/authz/pamacct.h
> create mode 100644 include/authz/simple.h
> delete mode 100644 include/qemu/acl.h
> create mode 100644 include/qemu/filemonitor.h
> create mode 100644 qapi/authz.json
> create mode 100644 tests/test-authz-list.c
> create mode 100644 tests/test-authz-listfile.c
> create mode 100644 tests/test-authz-pam.c
> create mode 100644 tests/test-authz-simple.c
> create mode 100644 tests/test-util-filemonitor.c
> delete mode 100644 util/acl.c
> create mode 100644 util/filemonitor-inotify.c
> create mode 100644 util/filemonitor-stub.c
>
> --
> 2.20.1
>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|