xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-27 05:20:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

monitor: deprecate acl_show, acl_reset, acl_policy, acl_add, acl_remove

Browse Source 
The various ACL related commands are obsolete now that the QAuthZ
framework for authorization is fully integrated throughout QEMU network
services. These only ever worked with VNC and were never used by libvirt.
Mark it as deprecated with no direct replacement to be provided.

Authorization is now provided by using 'object_add' together with
the 'tls-authz' or 'sasl-authz' parameters to the VNC server, and
equivalent for other network services.

Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20190227145755.26556-3-berrange@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2019-02-27 14:57:55 +00:00 committed by Gerd Hoffmann
parent 55cf09a02b
commit 0143840771
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
monitor.c
View File

@ -2032,6 +2032,19 @@ static QAuthZList *find_auth(Monitor *mon, const char *name)
return QAUTHZ_LIST(obj);
}
static bool warn_acl;
static void hmp_warn_acl(void)
{
if (warn_acl) {
return;
}
error_report("The acl_show, acl_reset, acl_policy, acl_add, acl_remove "
"commands are deprecated with no replacement. Authorization "
"for VNC should be performed using the pluggable QAuthZ "
"objects");
warn_acl = true;
}
static void hmp_acl_show(Monitor *mon, const QDict *qdict)
{
const char *aclname = qdict_get_str(qdict, "aclname");
@ -2039,6 +2052,8 @@ static void hmp_acl_show(Monitor *mon, const QDict *qdict)
QAuthZListRuleList *rules;
size_t i = 0;
hmp_warn_acl();
if (!auth) {
return;
}
@ -2062,6 +2077,8 @@ static void hmp_acl_reset(Monitor *mon, const QDict *qdict)
const char *aclname = qdict_get_str(qdict, "aclname");
QAuthZList *auth = find_auth(mon, aclname);
hmp_warn_acl();
if (!auth) {
return;
}
@ -2080,6 +2097,8 @@ static void hmp_acl_policy(Monitor *mon, const QDict *qdict)
int val;
Error *err = NULL;
hmp_warn_acl();
if (!auth) {
return;
}
@ -2124,6 +2143,8 @@ static void hmp_acl_add(Monitor *mon, const QDict *qdict)
QAuthZListFormat format;
size_t i = 0;
hmp_warn_acl();
if (!auth) {
return;
}
@ -2169,6 +2190,8 @@ static void hmp_acl_remove(Monitor *mon, const QDict *qdict)
QAuthZList *auth = find_auth(mon, aclname);
ssize_t i = 0;
hmp_warn_acl();
if (!auth) {
return;
}

6
qemu-deprecated.texi
View File

@ -104,6 +104,12 @@ The @option{[hub_id name]} parameter tuple of the 'hostfwd_add' and
Use ``device_add'' for hotplugging vCPUs instead of ``cpu-add''. See
documentation of ``query-hotpluggable-cpus'' for additional details.
@subsection acl_show, acl_reset, acl_policy, acl_add, acl_remove (since 4.0.0)
The ``acl_show'', ``acl_reset'', ``acl_policy'', ``acl_add'', and
``acl_remove'' commands are deprecated with no replacement. Authorization
for VNC should be performed using the pluggable QAuthZ objects.
@section System emulator devices
@subsection bluetooth (since 3.1)