Re: [Qemu-devel] [PATCH v5 08/11] authz: add QAuthZList object type for an access control list

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Oct 19, 2018 at 11:57:45AM +0200, Philippe Mathieu-Daudé wrote:
> On 09/10/2018 15:04, Daniel P. Berrangé wrote:
> > From: "Daniel P. Berrange" <berrange@redhat.com>
> > 
> > Add a QAuthZList object type that implements the QAuthZ interface. This
> > built-in implementation maintains a trivial access control list with a
> > sequence of match rules and a final default policy. This replicates the
> > functionality currently provided by the qemu_acl module.
> > 
> > To create an instance of this object via the QMP monitor, the syntax
> > used would be:
> > 
> >   {
> >     "execute": "object-add",
> >     "arguments": {
> >       "qom-type": "authz-list",
> >       "id": "authz0",
> >       "parameters": {
> >         "rules": [
> >            { "match": "fred", "policy": "allow", "format": "exact" },
> >            { "match": "bob", "policy": "allow", "format": "exact" },
> >            { "match": "danb", "policy": "deny", "format": "glob" },
> >            { "match": "dan*", "policy": "allow", "format": "exact" },
> >         ],
> >         "policy": "deny"
> >       }
> >     }
> >   }
> > 
> > This sets up an authorization rule that allows 'fred', 'bob' and anyone
> > whose name starts with 'dan', except for 'danb'. Everyone unmatched is
> > denied.
> > 
> > It is not currently possible to create this via -object, since there is
> > no syntax supported to specify non-scalar properties for objects. This
> > is likely to be addressed by later support for using JSON with -object,
> > or an equivalent approach.
> > 
> > In any case the future "authz-listfile" object can be used from the
> > CLI and is likely a better choice, as it allows the ACL to be refreshed
> > automatically on change.
> > +static void
> > +qauthz_list_prop_set_policy(Object *obj,
> > +                            int value,
> > +                            Error **errp G_GNUC_UNUSED)
> > +{
> > +    QAuthZList *bauthz = QAUTHZ_LIST(obj);
> > +
> 
> Here:
> 
>        g_free(bauthz->policy);

'policy' is an integer, so I don't think we need g_free(0x1) :-)

> 
> > +    bauthz->policy = value;
> > +}

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|