xref: /openbmc/qemu/include/authz/listfile.h (revision 74208cd2)
1 /*
2  * QEMU list file authorization driver
3  *
4  * Copyright (c) 2018 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #ifndef QAUTHZ_LISTFILE_H
22 #define QAUTHZ_LISTFILE_H
23 
24 #include "authz/list.h"
25 #include "qemu/filemonitor.h"
26 #include "qom/object.h"
27 
28 #define TYPE_QAUTHZ_LIST_FILE "authz-list-file"
29 
30 OBJECT_DECLARE_SIMPLE_TYPE(QAuthZListFile,
31                            QAUTHZ_LIST_FILE)
32 
33 
34 
35 /**
36  * QAuthZListFile:
37  *
38  * This authorization driver provides a file mechanism
39  * for granting access by matching user names against a
40  * file of globs. Each match rule has an associated policy
41  * and a catch all policy applies if no rule matches
42  *
43  * To create an instance of this class via QMP:
44  *
45  *  {
46  *    "execute": "object-add",
47  *    "arguments": {
48  *      "qom-type": "authz-list-file",
49  *      "id": "authz0",
50  *      "props": {
51  *        "filename": "/etc/qemu/myvm-vnc.acl",
52  *        "refresh": true
53  *      }
54  *    }
55  *  }
56  *
57  * If 'refresh' is 'yes', inotify is used to monitor for changes
58  * to the file and auto-reload the rules.
59  *
60  * The myvm-vnc.acl file should contain the parameters for
61  * the QAuthZList object in JSON format:
62  *
63  *      {
64  *        "rules": [
65  *           { "match": "fred", "policy": "allow", "format": "exact" },
66  *           { "match": "bob", "policy": "allow", "format": "exact" },
67  *           { "match": "danb", "policy": "deny", "format": "exact" },
68  *           { "match": "dan*", "policy": "allow", "format": "glob" }
69  *        ],
70  *        "policy": "deny"
71  *      }
72  *
73  * The object can be created on the command line using
74  *
75  *   -object authz-list-file,id=authz0,\
76  *           filename=/etc/qemu/myvm-vnc.acl,refresh=on
77  *
78  */
79 struct QAuthZListFile {
80     QAuthZ parent_obj;
81 
82     QAuthZ *list;
83     char *filename;
84     bool refresh;
85     QFileMonitor *file_monitor;
86     int64_t file_watch;
87 };
88 
89 
90 
91 
92 QAuthZListFile *qauthz_list_file_new(const char *id,
93                                      const char *filename,
94                                      bool refresh,
95                                      Error **errp);
96 
97 #endif /* QAUTHZ_LISTFILE_H */
98