[libvirt-users] Libvirt access control drivers

[Anastasiya Ruzhanskaya]

I read this page https://libvirt.org/aclpolkit.html
And it is written :"At this point in time, the only attribute provided by
libvirt to identify the user invoking the operation is the PID of the
client program. This means that the polkit access control driver is only
useful if connections to libvirt are restricted to its UNIX domain socket."

2018-05-09 11:00 GMT+03:00 Daniel P. Berrangé <berrange at redhat.com>:

> On Wed, May 09, 2018 at 09:46:28AM +0300, Anastasiya Ruzhanskaya wrote:
> > Hello!
> > According to the documentation access control drivers are not in really
> > "good condition". There is a polkit, but it can distinguish users only
> > according the pid. However, I have met some articles about more
> > fine-grained control and about selinux drivers for libvirt? So, what is
> the
> > status now? Should I implement something by myself if I want access based
> > on login, are their instructions how to write these drivers or there is
> > smth already?
>
> The polkit access control driver is the only one we support, and it is not
> something that end users can replace as this is not a public plugin system.
> Any alternate impl would have to be part of libvirt core.
>
> I'm not sure what docs you are referring to, but the polkit driver is in
> perfectly good condition. It is not restricted to just checking PIDs,
> in fact PID is largely irrelevant - user name and group membership are
> the important things to check. Ther is an example in the source tree at
> examples/polkit/libvirt-acl.rules showing a simple RBAC approach to using
> polkit.
>
> Regards,
> Daniel
> --
> |: https://berrange.com      -o-    https://www.flickr.com/photos/
> dberrange :|
> |: https://libvirt.org         -o-
> https://fstop138.berrange.com :|
> |: https://entangle-photo.org    -o-    https://www.instagram.com/
> dberrange :|
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvirt-users/attachments/20180509/12d6d2e3/attachment.htm>