[libvirt] [PATCH RFC v3 07/15] FSPool: added access control objects and permissions
Olga Krishtal
okrishtal at virtuozzo.com
Fri Dec 2 15:38:12 UTC 2016
Signed-off-by: Olga Krishtal <okrishtal at virtuozzo.com>
---
src/access/viraccessdriver.h | 15 +++++
src/access/viraccessdrivernop.c | 21 +++++++
src/access/viraccessdriverpolkit.c | 47 ++++++++++++++
src/access/viraccessdriverstack.c | 50 +++++++++++++++
src/access/viraccessmanager.c | 32 ++++++++++
src/access/viraccessmanager.h | 11 +++-
src/access/viraccessperm.c | 15 ++++-
src/access/viraccessperm.h | 126 +++++++++++++++++++++++++++++++++++++
src/libvirt_private.syms | 5 +-
9 files changed, 318 insertions(+), 4 deletions(-)
diff --git a/src/access/viraccessdriver.h b/src/access/viraccessdriver.h
index e3050b6..194aa2f 100644
--- a/src/access/viraccessdriver.h
+++ b/src/access/viraccessdriver.h
@@ -61,6 +61,19 @@ typedef int (*virAccessDriverCheckStorageVolDrv)(virAccessManagerPtr manager,
virStorageVolDefPtr vol,
virAccessPermStorageVol av);
+typedef int (*virAccessDriverCheckFSPoolDrv)(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virAccessPermFSPool av);
+typedef int (*virAccessDriverCheckFSItemDrv)(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virFSItemDefPtr item,
+ virAccessPermFSItem av);
+
+typedef int (*virAccessDriverSetupDrv)(virAccessManagerPtr manager);
+typedef void (*virAccessDriverCleanupDrv)(virAccessManagerPtr manager);
+
typedef int (*virAccessDriverSetupDrv)(virAccessManagerPtr manager);
typedef void (*virAccessDriverCleanupDrv)(virAccessManagerPtr manager);
@@ -83,6 +96,8 @@ struct _virAccessDriver {
virAccessDriverCheckSecretDrv checkSecret;
virAccessDriverCheckStoragePoolDrv checkStoragePool;
virAccessDriverCheckStorageVolDrv checkStorageVol;
+ virAccessDriverCheckFSPoolDrv checkFSPool;
+ virAccessDriverCheckFSItemDrv checkFSItem;
};
diff --git a/src/access/viraccessdrivernop.c b/src/access/viraccessdrivernop.c
index 86ceef3..a936711 100644
--- a/src/access/viraccessdrivernop.c
+++ b/src/access/viraccessdrivernop.c
@@ -104,6 +104,25 @@ virAccessDriverNopCheckStorageVol(virAccessManagerPtr manager ATTRIBUTE_UNUSED,
}
+static int
+virAccessDriverNopCheckFSPool(virAccessManagerPtr manager ATTRIBUTE_UNUSED,
+ const char *driverName ATTRIBUTE_UNUSED,
+ virFSPoolDefPtr fspool ATTRIBUTE_UNUSED,
+ virAccessPermFSPool perm ATTRIBUTE_UNUSED)
+{
+ return 1; /* Allow */
+}
+
+static int
+virAccessDriverNopCheckFSItem(virAccessManagerPtr manager ATTRIBUTE_UNUSED,
+ const char *driverName ATTRIBUTE_UNUSED,
+ virFSPoolDefPtr fspool ATTRIBUTE_UNUSED,
+ virFSItemDefPtr item ATTRIBUTE_UNUSED,
+ virAccessPermFSItem perm ATTRIBUTE_UNUSED)
+{
+ return 1; /* Allow */
+}
+
virAccessDriver accessDriverNop = {
.name = "none",
.checkConnect = virAccessDriverNopCheckConnect,
@@ -115,4 +134,6 @@ virAccessDriver accessDriverNop = {
.checkSecret = virAccessDriverNopCheckSecret,
.checkStoragePool = virAccessDriverNopCheckStoragePool,
.checkStorageVol = virAccessDriverNopCheckStorageVol,
+ .checkFSPool = virAccessDriverNopCheckFSPool,
+ .checkFSItem = virAccessDriverNopCheckFSItem,
};
diff --git a/src/access/viraccessdriverpolkit.c b/src/access/viraccessdriverpolkit.c
index 0d9e0a1..2beaf74 100644
--- a/src/access/viraccessdriverpolkit.c
+++ b/src/access/viraccessdriverpolkit.c
@@ -399,6 +399,51 @@ virAccessDriverPolkitCheckStorageVol(virAccessManagerPtr manager,
attrs);
}
+static int
+virAccessDriverPolkitCheckFSPool(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virAccessPermFSPool perm)
+{
+ char uuidstr[VIR_UUID_STRING_BUFLEN];
+ const char *attrs[] = {
+ "connect_driver", driverName,
+ "fspool_name", fspool->name,
+ "fspool_uuid", uuidstr,
+ NULL,
+ };
+ virUUIDFormat(fspool->uuid, uuidstr);
+
+ return virAccessDriverPolkitCheck(manager,
+ "fs-pool",
+ virAccessPermFSPoolTypeToString(perm),
+ attrs);
+}
+
+static int
+virAccessDriverPolkitCheckFSItem(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virFSItemDefPtr item,
+ virAccessPermFSItem perm)
+{
+ char uuidstr[VIR_UUID_STRING_BUFLEN];
+ const char *attrs[] = {
+ "connect_driver", driverName,
+ "fspool_name", fspool->name,
+ "fspool_uuid", uuidstr,
+ "item_name", item->name,
+ "item_key", item->key,
+ NULL,
+ };
+ virUUIDFormat(fspool->uuid, uuidstr);
+
+ return virAccessDriverPolkitCheck(manager,
+ "fs-item",
+ virAccessPermFSItemTypeToString(perm),
+ attrs);
+}
+
virAccessDriver accessDriverPolkit = {
.privateDataLen = sizeof(virAccessDriverPolkitPrivate),
.name = "polkit",
@@ -412,4 +457,6 @@ virAccessDriver accessDriverPolkit = {
.checkSecret = virAccessDriverPolkitCheckSecret,
.checkStoragePool = virAccessDriverPolkitCheckStoragePool,
.checkStorageVol = virAccessDriverPolkitCheckStorageVol,
+ .checkFSPool = virAccessDriverPolkitCheckFSPool,
+ .checkFSItem = virAccessDriverPolkitCheckFSItem,
};
diff --git a/src/access/viraccessdriverstack.c b/src/access/viraccessdriverstack.c
index b43a743..7fe1658 100644
--- a/src/access/viraccessdriverstack.c
+++ b/src/access/viraccessdriverstack.c
@@ -267,6 +267,54 @@ virAccessDriverStackCheckStorageVol(virAccessManagerPtr manager,
return ret;
}
+static int
+virAccessDriverStackCheckFSPool(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virAccessPermFSPool perm)
+{
+ virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager);
+ int ret = 1;
+ size_t i;
+
+ for (i = 0; i < priv->managersLen; i++) {
+ int rv;
+ /* We do not short-circuit on first denial - always check all drivers */
+ rv = virAccessManagerCheckFSPool(priv->managers[i], driverName, fspool, perm);
+ if (rv == 0 && ret != -1)
+ ret = 0;
+ else if (rv < 0)
+ ret = -1;
+ }
+
+ return ret;
+}
+
+static int
+virAccessDriverStackCheckFSItem(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virFSItemDefPtr item,
+ virAccessPermFSItem perm)
+{
+ virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager);
+ int ret = 1;
+ size_t i;
+
+ for (i = 0; i < priv->managersLen; i++) {
+ int rv;
+ /* We do not short-circuit on first denial - always check all drivers */
+ rv = virAccessManagerCheckFSItem(priv->managers[i], driverName, fspool, item, perm);
+ if (rv == 0 && ret != -1)
+ ret = 0;
+ else if (rv < 0)
+ ret = -1;
+ }
+
+ return ret;
+}
+
+
virAccessDriver accessDriverStack = {
.privateDataLen = sizeof(virAccessDriverStackPrivate),
.name = "stack",
@@ -280,4 +328,6 @@ virAccessDriver accessDriverStack = {
.checkSecret = virAccessDriverStackCheckSecret,
.checkStoragePool = virAccessDriverStackCheckStoragePool,
.checkStorageVol = virAccessDriverStackCheckStorageVol,
+ .checkFSPool = virAccessDriverStackCheckFSPool,
+ .checkFSItem = virAccessDriverStackCheckFSItem,
};
diff --git a/src/access/viraccessmanager.c b/src/access/viraccessmanager.c
index bcf552b..20a1260 100644
--- a/src/access/viraccessmanager.c
+++ b/src/access/viraccessmanager.c
@@ -344,3 +344,35 @@ int virAccessManagerCheckStorageVol(virAccessManagerPtr manager,
return virAccessManagerSanitizeError(ret);
}
+
+
+int virAccessManagerCheckFSPool(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virAccessPermFSPool perm)
+{
+ int ret = 0;
+ VIR_DEBUG("manager=%p(name=%s) driver=%s pool=%p perm=%d",
+ manager, manager->drv->name, driverName, fspool, perm);
+
+ if (manager->drv->checkFSPool)
+ ret = manager->drv->checkFSPool(manager, driverName, fspool, perm);
+
+ return virAccessManagerSanitizeError(ret);
+}
+
+int virAccessManagerCheckFSItem(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virFSItemDefPtr item,
+ virAccessPermFSItem perm)
+{
+ int ret = 0;
+ VIR_DEBUG("manager=%p(name=%s) driver=%s pool=%p vol=%p perm=%d",
+ manager, manager->drv->name, driverName, fspool, item, perm);
+
+ if (manager->drv->checkFSItem)
+ ret = manager->drv->checkFSItem(manager, driverName, fspool, item, perm);
+
+ return virAccessManagerSanitizeError(ret);
+}
diff --git a/src/access/viraccessmanager.h b/src/access/viraccessmanager.h
index e7eb15d..5c74572 100644
--- a/src/access/viraccessmanager.h
+++ b/src/access/viraccessmanager.h
@@ -29,6 +29,7 @@
# include "conf/storage_conf.h"
# include "conf/secret_conf.h"
# include "conf/interface_conf.h"
+# include "conf/fs_conf.h"
# include "access/viraccessperm.h"
typedef struct _virAccessManager virAccessManager;
@@ -86,6 +87,14 @@ int virAccessManagerCheckStorageVol(virAccessManagerPtr manager,
virStoragePoolDefPtr pool,
virStorageVolDefPtr vol,
virAccessPermStorageVol perm);
-
+int virAccessManagerCheckFSPool(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virAccessPermFSPool perm);
+int virAccessManagerCheckFSItem(virAccessManagerPtr manager,
+ const char *driverName,
+ virFSPoolDefPtr fspool,
+ virFSItemDefPtr item,
+ virAccessPermFSItem perm);
#endif /* __VIR_ACCESS_MANAGER_H__ */
diff --git a/src/access/viraccessperm.c b/src/access/viraccessperm.c
index 0f58290..8fe5bbf 100644
--- a/src/access/viraccessperm.c
+++ b/src/access/viraccessperm.c
@@ -31,7 +31,7 @@ VIR_ENUM_IMPL(virAccessPermConnect,
"search_interfaces", "search_secrets",
"search_nwfilters",
"detect_storage_pools", "pm_control",
- "interface_transaction");
+ "interface_transaction", "search_fspools");
VIR_ENUM_IMPL(virAccessPermDomain,
VIR_ACCESS_PERM_DOMAIN_LAST,
@@ -83,3 +83,16 @@ VIR_ENUM_IMPL(virAccessPermStorageVol,
"getattr", "read", "create", "delete",
"format", "resize", "data_read",
"data_write");
+
+VIR_ENUM_IMPL(virAccessPermFSPool,
+ VIR_ACCESS_PERM_FSPOOL_LAST,
+ "getattr", "read", "write",
+ "save", "delete", "start", "stop",
+ "refresh", "search_items",
+ "format");
+
+VIR_ENUM_IMPL(virAccessPermFSItem,
+ VIR_ACCESS_PERM_FSITEM_LAST,
+ "getattr", "read", "create", "delete",
+ "format", "data_read",
+ "data_write");
diff --git a/src/access/viraccessperm.h b/src/access/viraccessperm.h
index 1817da7..b8e2531 100644
--- a/src/access/viraccessperm.h
+++ b/src/access/viraccessperm.h
@@ -113,6 +113,13 @@ typedef enum {
*/
VIR_ACCESS_PERM_CONNECT_INTERFACE_TRANSACTION,
+ /**
+ * * @desc: List fs pools
+ * * @message: Listing fs pools requires authorization
+ * * @anonymous: 1
+ * */
+ VIR_ACCESS_PERM_CONNECT_SEARCH_FSPOOLS,
+
VIR_ACCESS_PERM_CONNECT_LAST,
} virAccessPermConnect;
@@ -651,6 +658,123 @@ typedef enum {
VIR_ACCESS_PERM_STORAGE_VOL_LAST
} virAccessPermStorageVol;
+typedef enum {
+
+ /**
+ * @desc: Access fs pool
+ * @message: Accessing fs pool requires authorization
+ * @anonymous: 1
+ */
+ VIR_ACCESS_PERM_FSPOOL_GETATTR,
+
+ /**
+ * @desc: Read fs pool
+ * @message: Reading fs pool configuration requires authorization
+ * @anonymous: 1
+ */
+ VIR_ACCESS_PERM_FSPOOL_READ,
+
+ /**
+ * @desc: Write fs pool
+ * @message: Writing fs pool configuration requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_WRITE,
+
+ /**
+ * @desc: Save fs pool
+ * @message: Saving fs pool configuration requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_SAVE,
+
+ /**
+ * @desc: Delete fs pool
+ * @message: Deleting fs pool configuration requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_DELETE,
+
+ /**
+ * @desc: Start fs pool
+ * @message: Starting fs pool configuration requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_START,
+
+ /**
+ * @desc: Stop fs pool
+ * @message: Stopping fs pool configuration requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_STOP,
+
+ /**
+ * @desc: Refresh fs pool
+ * @message: Refreshing fs pool items requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_REFRESH,
+
+ /**
+ * @desc: List fs pool items
+ * @message: Listing fs pool items requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_SEARCH_ITEMS,
+
+ /**
+ * @desc: Format fs pool
+ * @message: Formatting fs pool data requires authorization
+ */
+ VIR_ACCESS_PERM_FSPOOL_FORMAT,
+
+ VIR_ACCESS_PERM_FSPOOL_LAST
+} virAccessPermFSPool;
+
+typedef enum {
+
+ /**
+ * @desc: Access fs item
+ * @message: Acceessing fs item requires authorization
+ * @anonymous: 1
+ */
+ VIR_ACCESS_PERM_FSITEM_GETATTR,
+
+ /**
+ * @desc: Read fs item
+ * @message: Reading fs item configuration requires authorization
+ * @anonymous: 1
+ */
+ VIR_ACCESS_PERM_FSITEM_READ,
+
+ /**
+ * @desc: Create fs item
+ * @message: Creating fs item requires authorization
+ */
+ VIR_ACCESS_PERM_FSITEM_CREATE,
+
+ /**
+ * @desc: Delete fs item
+ * @message: Deleting fs item requires authorization
+ */
+ VIR_ACCESS_PERM_FSITEM_DELETE,
+
+ /**
+ * @desc: Format fs item
+ * @message: Formatting fs item data requires authorization
+ */
+ VIR_ACCESS_PERM_FSITEM_FORMAT,
+
+ /**
+ * @desc: Read fs item data
+ * @message: Reading fs item data requires authorization
+ */
+ VIR_ACCESS_PERM_FSITEM_DATA_READ,
+
+ /**
+ * @desc: Write fs item data
+ * @message: Writing fs item data requires authorization
+ */
+ VIR_ACCESS_PERM_FSITEM_DATA_WRITE,
+
+ VIR_ACCESS_PERM_FSITEM_LAST
+} virAccessPermFSItem;
+
+
VIR_ENUM_DECL(virAccessPermConnect);
VIR_ENUM_DECL(virAccessPermDomain);
VIR_ENUM_DECL(virAccessPermInterface);
@@ -660,5 +784,7 @@ VIR_ENUM_DECL(virAccessPermNWFilter);
VIR_ENUM_DECL(virAccessPermSecret);
VIR_ENUM_DECL(virAccessPermStoragePool);
VIR_ENUM_DECL(virAccessPermStorageVol);
+VIR_ENUM_DECL(virAccessPermFSPool);
+VIR_ENUM_DECL(virAccessPermFSItem);
#endif /* __VIR_ACCESS_PERM_H__ */
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 8589394..a14dfc8 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -19,7 +19,8 @@ virAccessManagerGetDefault;
virAccessManagerNew;
virAccessManagerNewStack;
virAccessManagerSetDefault;
-
+virAccessManagerCheckFSItem;
+virAccessManagerCheckFSPool;
# access/viraccessperm.h
virAccessPermConnectTypeFromString;
@@ -40,7 +41,7 @@ virAccessPermStoragePoolTypeFromString;
virAccessPermStoragePoolTypeToString;
virAccessPermStorageVolTypeFromString;
virAccessPermStorageVolTypeToString;
-
+virAccessPermFSPoolTypeToString;
# conf/capabilities.h
virCapabilitiesAddGuest;
--
1.8.3.1
More information about the libvir-list
mailing list