Re: [Qemu-devel] [PATCH v5 08/11] authz: add QAuthZList object type for an access control list

[Daniel P . Berrangé]

On Fri, Oct 19, 2018 at 11:33:06AM +0200, Philippe Mathieu-Daudé wrote:
> Hi Daniel,
> 
> On 09/10/2018 15:04, Daniel P. Berrangé wrote:
> > From: "Daniel P. Berrange" <address@hidden>
> > 
> > Add a QAuthZList object type that implements the QAuthZ interface. This
> > built-in implementation maintains a trivial access control list with a
> > sequence of match rules and a final default policy. This replicates the
> > functionality currently provided by the qemu_acl module.
> > 
> > To create an instance of this object via the QMP monitor, the syntax
> > used would be:
> > 
> >   {
> >     "execute": "object-add",
> >     "arguments": {
> >       "qom-type": "authz-list",
> >       "id": "authz0",
> >       "parameters": {
> >         "rules": [
> >            { "match": "fred", "policy": "allow", "format": "exact" },
> >            { "match": "bob", "policy": "allow", "format": "exact" },
> >            { "match": "danb", "policy": "deny", "format": "glob" },
> >            { "match": "dan*", "policy": "allow", "format": "exact" },
> >         ],
> >         "policy": "deny"
> >       }
> >     }
> >   }
> > 
> > This sets up an authorization rule that allows 'fred', 'bob' and anyone
> > whose name starts with 'dan', except for 'danb'. Everyone unmatched is
> > denied.
> > 
> > It is not currently possible to create this via -object, since there is
> > no syntax supported to specify non-scalar properties for objects. This
> > is likely to be addressed by later support for using JSON with -object,
> > or an equivalent approach.
> > 
> > In any case the future "authz-listfile" object can be used from the
> > CLI and is likely a better choice, as it allows the ACL to be refreshed
> > automatically on change.
> > 
> > Signed-off-by: Daniel P. Berrange <address@hidden>
> > ---
> >  .gitignore              |   4 +
> >  MAINTAINERS             |   1 +
> >  Makefile                |   7 +-
> >  Makefile.objs           |   4 +
> >  authz/Makefile.objs     |   1 +
> >  authz/list.c            | 315 ++++++++++++++++++++++++++++++++++++++++
> >  authz/trace-events      |   4 +
> >  include/authz/list.h    | 106 ++++++++++++++

> > +static void
> > +qauthz_list_complete(UserCreatable *uc, Error **errp)
> > +{
> 
> Is this useful?
> 
> > +}

No, and it seems we can omit it safely. Same for the previous
patch in this series in fact.

> > +
> > +
> > +static void
> > +qauthz_list_finalize(Object *obj)
> > +{
> 
> Ditto.

Opps, it should be freeing the 'rules' field.


> > +ssize_t qauthz_list_append_rule(QAuthZList *auth,
> > +                                const char *match,
> > +                                QAuthZListPolicy policy,
> > +                                QAuthZListFormat format,
> > +                                Error **errp)
> > +{
> > +    QAuthZListRule *rule;
> > +    QAuthZListRuleList *rules, *tmp;
> > +    size_t i = 0;
> > +
> > +#ifndef CONFIG_FNMATCH
> > +    if (format == QAUTHZ_LIST_FORMAT_GLOB) {
> > +        error_setg(errp, "Glob format not supported on this platform");
> > +        return -1;
> > +    }
> > +#endif
> > +
> > +    rule = g_new0(QAuthZListRule, 1);
> > +    rule->policy = policy;
> > +    rule->match = g_strdup(match);
> > +    rule->format = format;
> > +    rule->has_format = true;
> > +
> > +    tmp = g_new0(QAuthZListRuleList, 1);
> > +    tmp->value = rule;
> > +
> > +    rules = auth->rules;
> > +    if (rules) {
> > +        while (rules->next) {
> > +            i++;
> > +            rules = rules->next;
> > +        }
> > +        rules->next = tmp;
> > +        return i + 1;
> > +    } else {
> > +        auth->rules = tmp;
> > +        return 0;
> > +    }
> 
> Can we manage the rules with the QSLIST macros?

Those macros require specific struct field  names, and the
QAuthZListRuleList struct is auto-generated from QAPI so
lacking these fields.


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|