LXR qemu/include/authz/pamacct.h

   1/*
   2 * QEMU PAM authorization driver
   3 *
   4 * Copyright (c) 2018 Red Hat, Inc.
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 *
  19 */
  20
  21#ifndef QAUTHZ_PAMACCT_H
  22#define QAUTHZ_PAMACCT_H
  23
  24#include "authz/base.h"
  25
  26
  27#define TYPE_QAUTHZ_PAM "authz-pam"
  28
  29#define QAUTHZ_PAM_CLASS(klass) \
  30     OBJECT_CLASS_CHECK(QAuthZPAMClass, (klass), \
  31                        TYPE_QAUTHZ_PAM)
  32#define QAUTHZ_PAM_GET_CLASS(obj) \
  33     OBJECT_GET_CLASS(QAuthZPAMClass, (obj), \
  34                      TYPE_QAUTHZ_PAM)
  35#define QAUTHZ_PAM(obj) \
  36     OBJECT_CHECK(QAuthZPAM, (obj), \
  37                  TYPE_QAUTHZ_PAM)
  38
  39typedef struct QAuthZPAM QAuthZPAM;
  40typedef struct QAuthZPAMClass QAuthZPAMClass;
  41
  42
  43/**
  44 * QAuthZPAM:
  45 *
  46 * This authorization driver provides a PAM mechanism
  47 * for granting access by matching user names against a
  48 * list of globs. Each match rule has an associated policy
  49 * and a catch all policy applies if no rule matches
  50 *
  51 * To create an instance of this class via QMP:
  52 *
  53 *  {
  54 *    "execute": "object-add",
  55 *    "arguments": {
  56 *      "qom-type": "authz-pam",
  57 *      "id": "authz0",
  58 *      "parameters": {
  59 *        "service": "qemu-vnc-tls"
  60 *      }
  61 *    }
  62 *  }
  63 *
  64 * The driver only uses the PAM "account" verification
  65 * subsystem. The above config would require a config
  66 * file /etc/pam.d/qemu-vnc-tls. For a simple file
  67 * lookup it would contain
  68 *
  69 *   account requisite  pam_listfile.so item=user sense=allow \
  70 *           file=/etc/qemu/vnc.allow
  71 *
  72 * The external file would then contain a list of usernames.
  73 * If x509 cert was being used as the username, a suitable
  74 * entry would match the distinguish name:
  75 *
  76 *  CN=laptop.berrange.com,O=Berrange Home,L=London,ST=London,C=GB
  77 *
  78 * On the command line it can be created using
  79 *
  80 *   -object authz-pam,id=authz0,service=qemu-vnc-tls
  81 *
  82 */
  83struct QAuthZPAM {
  84    QAuthZ parent_obj;
  85
  86    char *service;
  87};
  88
  89
  90struct QAuthZPAMClass {
  91    QAuthZClass parent_class;
  92};
  93
  94
  95QAuthZPAM *qauthz_pam_new(const char *id,
  96                          const char *service,
  97                          Error **errp);
  98
  99#endif /* QAUTHZ_PAMACCT_H */
 100