<div dir="ltr"><div>Excuse me for renewing this discussion, but I am curious if you would add new module, which will be able to process users not based on unix processes, from where do you plan to get usernames? I mean, virt-manager could give them, as there is authentication in GUI, but for example when using oVirt, none of the usernames reach libvirt through the communication between server and nodes.<br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2018-05-09 14:46 GMT+03:00 Anastasiya Ruzhanskaya <span dir="ltr"><<a href="mailto:anastasiya.ruzhanskaya@frtk.ru" target="_blank">anastasiya.ruzhanskaya@frtk.ru</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Great, thanks for pointing this out. I will certainly look at it.<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">2018-05-09 14:41 GMT+03:00 Daniel P. Berrangé <span dir="ltr"><<a href="mailto:berrange@redhat.com" target="_blank">berrange@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Wed, May 09, 2018 at 10:00:19AM +0100, Daniel P. Berrangé wrote:<br>
> On Wed, May 09, 2018 at 11:50:33AM +0300, Anastasiya Ruzhanskaya wrote:<br>
> > Here <a href="https://libvirt.org/acl.html" rel="noreferrer" target="_blank">https://libvirt.org/acl.html</a> is stated that you designed this access<br>
> > control system as pluggable. Are there any options ( even with modifying<br>
> > libvirt code) to plug in any custom driver?<br>
> > I just need to take a try and design something that will support remote<br>
> > access control.<br>
> > I am not sure if sVirt is the right thing I should look at.<br>
> <br>
> It is pluggable in the sense that we can write more backends for it<br>
> without having to refactor the rest of libvirt codebase. It isn't<br>
> pluggable from POV of an end user wishing to change it - it needs<br>
> contribution to libvirt code to add more options.<br>
> <br>
> I did look at creating an SELinux plugin many years ago, but the<br>
> number of new SELinux AVs to be defined was huge and I wasn't sure<br>
> the complexity of policy would be practical to handle in real world.<br>
> Also, SELinux with TCP adds an extra level of complexity as you now<br>
> need to figure out IPSec setup to pass SELinux labels across the<br>
> network from the client.<br>
> <br>
> Probably what we would more usefully add is a simple RBAC based<br>
> module natively in libvirt.<br>
<br>
</span>I forgot to say that if you want to look at writing a new impl the code<br>
is kept in $GIT/src/access/.<br>
<br>
The current polkit impl is viraccessdriverpolkit.c. Implementing a new<br>
driver involves creating a new source file with a virAccessDriver<br>
struct that contains pointers to the methods that implement the desired<br>
logic.<br>
<div class="m_-5978698213947611750HOEnZb"><div class="m_-5978698213947611750h5"><br>
<br>
Regards,<br>
Daniel<br>
-- <br>
|: <a href="https://berrange.com" rel="noreferrer" target="_blank">https://berrange.com</a> -o- <a href="https://www.flickr.com/photos/dberrange" rel="noreferrer" target="_blank">https://www.flickr.com/photos/<wbr>dberrange</a> :|<br>
|: <a href="https://libvirt.org" rel="noreferrer" target="_blank">https://libvirt.org</a> -o- <a href="https://fstop138.berrange.com" rel="noreferrer" target="_blank">https://fstop138.berrange.com</a> :|<br>
|: <a href="https://entangle-photo.org" rel="noreferrer" target="_blank">https://entangle-photo.org</a> -o- <a href="https://www.instagram.com/dberrange" rel="noreferrer" target="_blank">https://www.instagram.com/dber<wbr>range</a> :|<br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>