1 /* 2 * QEMU access control list file authorization driver 3 * 4 * Copyright (c) 2018 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "authz/listfile.h" 23 #include "trace.h" 24 #include "qemu/error-report.h" 25 #include "qemu/main-loop.h" 26 #include "qemu/sockets.h" 27 #include "qemu/filemonitor.h" 28 #include "qom/object_interfaces.h" 29 #include "qapi/qapi-visit-authz.h" 30 #include "qapi/qmp/qjson.h" 31 #include "qapi/qmp/qobject.h" 32 #include "qapi/qmp/qerror.h" 33 #include "qapi/qobject-input-visitor.h" 34 35 36 static bool 37 qauthz_list_file_is_allowed(QAuthZ *authz, 38 const char *identity, 39 Error **errp) 40 { 41 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(authz); 42 if (fauthz->list) { 43 return qauthz_is_allowed(fauthz->list, identity, errp); 44 } 45 46 return false; 47 } 48 49 50 static QAuthZ * 51 qauthz_list_file_load(QAuthZListFile *fauthz, Error **errp) 52 { 53 GError *err = NULL; 54 gchar *content = NULL; 55 gsize len; 56 QObject *obj = NULL; 57 QDict *pdict; 58 Visitor *v = NULL; 59 QAuthZ *ret = NULL; 60 61 trace_qauthz_list_file_load(fauthz, fauthz->filename); 62 if (!g_file_get_contents(fauthz->filename, &content, &len, &err)) { 63 error_setg(errp, "Unable to read '%s': %s", 64 fauthz->filename, err->message); 65 goto cleanup; 66 } 67 68 obj = qobject_from_json(content, errp); 69 if (!obj) { 70 goto cleanup; 71 } 72 73 pdict = qobject_to(QDict, obj); 74 if (!pdict) { 75 error_setg(errp, QERR_INVALID_PARAMETER_TYPE, "obj", "dict"); 76 goto cleanup; 77 } 78 79 v = qobject_input_visitor_new(obj); 80 81 ret = (QAuthZ *)user_creatable_add_type(TYPE_QAUTHZ_LIST, 82 NULL, pdict, v, errp); 83 84 cleanup: 85 visit_free(v); 86 qobject_unref(obj); 87 if (err) { 88 g_error_free(err); 89 } 90 g_free(content); 91 return ret; 92 } 93 94 95 static void 96 qauthz_list_file_event(int64_t wd G_GNUC_UNUSED, 97 QFileMonitorEvent ev G_GNUC_UNUSED, 98 const char *name G_GNUC_UNUSED, 99 void *opaque) 100 { 101 QAuthZListFile *fauthz = opaque; 102 Error *err = NULL; 103 104 if (ev != QFILE_MONITOR_EVENT_MODIFIED && 105 ev != QFILE_MONITOR_EVENT_CREATED) { 106 return; 107 } 108 109 object_unref(OBJECT(fauthz->list)); 110 fauthz->list = qauthz_list_file_load(fauthz, &err); 111 trace_qauthz_list_file_refresh(fauthz, 112 fauthz->filename, fauthz->list ? 1 : 0); 113 if (!fauthz->list) { 114 error_report_err(err); 115 } 116 } 117 118 static void 119 qauthz_list_file_complete(UserCreatable *uc, Error **errp) 120 { 121 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(uc); 122 gchar *dir = NULL, *file = NULL; 123 124 fauthz->list = qauthz_list_file_load(fauthz, errp); 125 126 if (!fauthz->refresh) { 127 return; 128 } 129 130 fauthz->file_monitor = qemu_file_monitor_new(errp); 131 if (!fauthz->file_monitor) { 132 return; 133 } 134 135 dir = g_path_get_dirname(fauthz->filename); 136 if (g_str_equal(dir, ".")) { 137 error_setg(errp, "Filename must be an absolute path"); 138 goto cleanup; 139 } 140 file = g_path_get_basename(fauthz->filename); 141 if (g_str_equal(file, ".")) { 142 error_setg(errp, "Path has no trailing filename component"); 143 goto cleanup; 144 } 145 146 fauthz->file_watch = qemu_file_monitor_add_watch( 147 fauthz->file_monitor, dir, file, 148 qauthz_list_file_event, fauthz, errp); 149 if (fauthz->file_watch < 0) { 150 goto cleanup; 151 } 152 153 cleanup: 154 g_free(file); 155 g_free(dir); 156 } 157 158 159 static void 160 qauthz_list_file_prop_set_filename(Object *obj, 161 const char *value, 162 Error **errp G_GNUC_UNUSED) 163 { 164 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj); 165 166 g_free(fauthz->filename); 167 fauthz->filename = g_strdup(value); 168 } 169 170 171 static char * 172 qauthz_list_file_prop_get_filename(Object *obj, 173 Error **errp G_GNUC_UNUSED) 174 { 175 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj); 176 177 return g_strdup(fauthz->filename); 178 } 179 180 181 static void 182 qauthz_list_file_prop_set_refresh(Object *obj, 183 bool value, 184 Error **errp G_GNUC_UNUSED) 185 { 186 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj); 187 188 fauthz->refresh = value; 189 } 190 191 192 static bool 193 qauthz_list_file_prop_get_refresh(Object *obj, 194 Error **errp G_GNUC_UNUSED) 195 { 196 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj); 197 198 return fauthz->refresh; 199 } 200 201 202 static void 203 qauthz_list_file_finalize(Object *obj) 204 { 205 QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj); 206 207 object_unref(OBJECT(fauthz->list)); 208 g_free(fauthz->filename); 209 qemu_file_monitor_free(fauthz->file_monitor); 210 } 211 212 213 static void 214 qauthz_list_file_class_init(ObjectClass *oc, void *data) 215 { 216 UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc); 217 QAuthZClass *authz = QAUTHZ_CLASS(oc); 218 219 ucc->complete = qauthz_list_file_complete; 220 221 object_class_property_add_str(oc, "filename", 222 qauthz_list_file_prop_get_filename, 223 qauthz_list_file_prop_set_filename, 224 NULL); 225 object_class_property_add_bool(oc, "refresh", 226 qauthz_list_file_prop_get_refresh, 227 qauthz_list_file_prop_set_refresh, 228 NULL); 229 230 authz->is_allowed = qauthz_list_file_is_allowed; 231 } 232 233 234 static void 235 qauthz_list_file_init(Object *obj) 236 { 237 QAuthZListFile *authz = QAUTHZ_LIST_FILE(obj); 238 239 authz->file_watch = -1; 240 #ifdef CONFIG_INOTIFY1 241 authz->refresh = TRUE; 242 #endif 243 } 244 245 246 QAuthZListFile *qauthz_list_file_new(const char *id, 247 const char *filename, 248 bool refresh, 249 Error **errp) 250 { 251 return QAUTHZ_LIST_FILE( 252 object_new_with_props(TYPE_QAUTHZ_LIST_FILE, 253 object_get_objects_root(), 254 id, errp, 255 "filename", filename, 256 "refresh", refresh ? "yes" : "no", 257 NULL)); 258 } 259 260 261 static const TypeInfo qauthz_list_file_info = { 262 .parent = TYPE_QAUTHZ, 263 .name = TYPE_QAUTHZ_LIST_FILE, 264 .instance_init = qauthz_list_file_init, 265 .instance_size = sizeof(QAuthZListFile), 266 .instance_finalize = qauthz_list_file_finalize, 267 .class_size = sizeof(QAuthZListFileClass), 268 .class_init = qauthz_list_file_class_init, 269 .interfaces = (InterfaceInfo[]) { 270 { TYPE_USER_CREATABLE }, 271 { } 272 } 273 }; 274 275 276 static void 277 qauthz_list_file_register_types(void) 278 { 279 type_register_static(&qauthz_list_file_info); 280 } 281 282 283 type_init(qauthz_list_file_register_types); 284