[Qemu-commits] [qemu/qemu] 90e33d: util: add helper APIs for dealing with inotify in ...

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 90e33dfec651c04d75f20a4e5c20593145c5d90e
      
https://github.com/qemu/qemu/commit/90e33dfec651c04d75f20a4e5c20593145c5d90e
  Author: Daniel P. Berrangé <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M MAINTAINERS
    M Makefile.objs
    A include/qemu/filemonitor.h
    M tests/Makefile.include
    A tests/test-util-filemonitor.c
    M util/Makefile.objs
    A util/filemonitor-inotify.c
    A util/filemonitor-stub.c
    M util/trace-events

  Log Message:
  -----------
  util: add helper APIs for dealing with inotify in portable manner

The inotify userspace API for reading events is quite horrible, so it is
useful to wrap it in a more friendly API to avoid duplicating code
across many users in QEMU. Wrapping it also allows introduction of a
platform portability layer, so that we can add impls for non-Linux based
equivalents in future.

Reviewed-by: Marc-André Lureau <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>


  Commit: 6134d7522e570a30d7f0d1e092ee37351c5183ed
      
https://github.com/qemu/qemu/commit/6134d7522e570a30d7f0d1e092ee37351c5183ed
  Author: Daniel P. Berrangé <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M qom/object.c
    M qom/object_interfaces.c

  Log Message:
  -----------
  qom: don't require user creatable objects to be registered

When an object is in turn owned by another user object, it is not
desirable to expose this in the QOM object hierarchy. It is just an
internal implementation detail, we should be free to change without
exposure to apps managing QEMU.

Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>


  Commit: 3c48baf1d43ca0f9a74f5a9e5286fde81da97021
      
https://github.com/qemu/qemu/commit/3c48baf1d43ca0f9a74f5a9e5286fde81da97021
  Author: Daniel P. Berrangé <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M hw/usb/dev-mtp.c

  Log Message:
  -----------
  hw/usb: don't set IN_ISDIR for inotify watch in MTP driver

IN_ISDIR is not a bit that one can request when registering a
watch with inotify_add_watch. Rather it is a bit that is set
automatically when reading events from the kernel.

Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>


  Commit: 888e0359bff48720b96599270ad7992e272b8a19
      
https://github.com/qemu/qemu/commit/888e0359bff48720b96599270ad7992e272b8a19
  Author: Daniel P. Berrangé <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M hw/usb/dev-mtp.c

  Log Message:
  -----------
  hw/usb: fix const-ness for string params in MTP driver

Various functions accepting 'char *' string parameters were missing
'const' qualifiers.

Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>


  Commit: 47287c27d0c367a89f7b2851e23a7f8b2d499dd6
      
https://github.com/qemu/qemu/commit/47287c27d0c367a89f7b2851e23a7f8b2d499dd6
  Author: Daniel P. Berrangé <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M hw/usb/dev-mtp.c
    M hw/usb/trace-events

  Log Message:
  -----------
  hw/usb: switch MTP to use new inotify APIs

The internal inotify APIs allow a lot of conditional statements to be
cleared out, and provide a simpler callback for handling events.

Reviewed-by: Marc-André Lureau <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>


  Commit: 5b76dd132c5346f335a85161dddaae022b47ccf9
      
https://github.com/qemu/qemu/commit/5b76dd132c5346f335a85161dddaae022b47ccf9
  Author: Daniel P. Berrange <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M MAINTAINERS
    M Makefile
    M Makefile.objs
    M Makefile.target
    A authz/Makefile.objs
    A authz/base.c
    A authz/trace-events
    A include/authz/base.h

  Log Message:
  -----------
  authz: add QAuthZ object as an authorization base class

The current qemu_acl module provides a simple access control list
facility inside QEMU, which is used via a set of monitor commands
acl_show, acl_policy, acl_add, acl_remove & acl_reset.

Note there is no ability to create ACLs - the network services (eg VNC
server) were expected to create ACLs that they want to check.

There is also no way to define ACLs on the command line, nor potentially
integrate with external authorization systems like polkit, pam, ldap
lookup, etc.

The QAuthZ object defines a minimal abstract QOM class that can be
subclassed for creating different authorization providers.

Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>


  Commit: fb5c4ebc0872e5f41634aec2f5a2cb5d83aefcd0
      
https://github.com/qemu/qemu/commit/fb5c4ebc0872e5f41634aec2f5a2cb5d83aefcd0
  Author: Daniel P. Berrangé <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M authz/Makefile.objs
    A authz/simple.c
    M authz/trace-events
    A include/authz/simple.h
    M qemu-options.hx
    M tests/Makefile.include
    A tests/test-authz-simple.c

  Log Message:
  -----------
  authz: add QAuthZSimple object type for easy whitelist auth checks

In many cases a single VM will just need to whitelist a single identity
as the allowed user of network services. This is especially the case for
TLS live migration (optionally with NBD storage) where we just need to
whitelist the x509 certificate distinguished name of the source QEMU
host.

Via QMP this can be configured with:

  {
    "execute": "object-add",
    "arguments": {
      "qom-type": "authz-simple",
      "id": "authz0",
      "props": {
        "identity": "fred"
      }
    }
  }

Or via the command line

  -object authz-simple,id=authz0,identity=fred

Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>


  Commit: c8c99887d119197e9f670e786db5b045c0470542
      
https://github.com/qemu/qemu/commit/c8c99887d119197e9f670e786db5b045c0470542
  Author: Daniel P. Berrange <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M MAINTAINERS
    M authz/Makefile.objs
    A authz/list.c
    M authz/trace-events
    A include/authz/list.h
    M qapi/Makefile.objs
    A qapi/authz.json
    M qapi/qapi-schema.json
    M tests/Makefile.include
    A tests/test-authz-list.c

  Log Message:
  -----------
  authz: add QAuthZList object type for an access control list

Add a QAuthZList object type that implements the QAuthZ interface. This
built-in implementation maintains a trivial access control list with a
sequence of match rules and a final default policy. This replicates the
functionality currently provided by the qemu_acl module.

To create an instance of this object via the QMP monitor, the syntax
used would be:

  {
    "execute": "object-add",
    "arguments": {
      "qom-type": "authz-list",
      "id": "authz0",
      "props": {
        "rules": [
           { "match": "fred", "policy": "allow", "format": "exact" },
           { "match": "bob", "policy": "allow", "format": "exact" },
           { "match": "danb", "policy": "deny", "format": "glob" },
           { "match": "dan*", "policy": "allow", "format": "exact" },
        ],
        "policy": "deny"
      }
    }
  }

This sets up an authorization rule that allows 'fred', 'bob' and anyone
whose name starts with 'dan', except for 'danb'. Everyone unmatched is
denied.

It is not currently possible to create this via -object, since there is
no syntax supported to specify non-scalar properties for objects. This
is likely to be addressed by later support for using JSON with -object,
or an equivalent approach.

In any case the future "authz-listfile" object can be used from the
CLI and is likely a better choice, as it allows the ACL to be refreshed
automatically on change.

Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>


  Commit: 55d869846de802a16af1a50584c51737bd664387
      
https://github.com/qemu/qemu/commit/55d869846de802a16af1a50584c51737bd664387
  Author: Daniel P. Berrangé <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M authz/Makefile.objs
    A authz/listfile.c
    M authz/trace-events
    A include/authz/listfile.h
    M qemu-options.hx
    M tests/Makefile.include
    A tests/test-authz-listfile.c

  Log Message:
  -----------
  authz: add QAuthZListFile object type for a file access control list

Add a QAuthZListFile object type that implements the QAuthZ interface. This
built-in implementation is a proxy around the QAuthZList object type,
initializing it from an external file, and optionally, automatically
reloading it whenever it changes.

To create an instance of this object via the QMP monitor, the syntax
used would be:

      {
        "execute": "object-add",
        "arguments": {
          "qom-type": "authz-list-file",
          "id": "authz0",
          "props": {
            "filename": "/etc/qemu/vnc.acl",
            "refresh": true
          }
        }
      }

If "refresh" is "yes", inotify is used to monitor the file,
automatically reloading changes. If an error occurs during reloading,
all authorizations will fail until the file is next successfully
loaded.

The /etc/qemu/vnc.acl file would contain a JSON representation of a
QAuthZList object

    {
      "rules": [
         { "match": "fred", "policy": "allow", "format": "exact" },
         { "match": "bob", "policy": "allow", "format": "exact" },
         { "match": "danb", "policy": "deny", "format": "glob" },
         { "match": "dan*", "policy": "allow", "format": "exact" },
      ],
      "policy": "deny"
    }

This sets up an authorization rule that allows 'fred', 'bob' and anyone
whose name starts with 'dan', except for 'danb'. Everyone unmatched is
denied.

The object can be loaded on the comand line using

   -object authz-list-file,id=authz0,filename=/etc/qemu/vnc.acl,refresh=yes

Reviewed-by: Marc-André Lureau <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>


  Commit: 8953caf3cd38534f8f63f4250f4ba4b4da4ff543
      
https://github.com/qemu/qemu/commit/8953caf3cd38534f8f63f4250f4ba4b4da4ff543
  Author: Daniel P. Berrange <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M authz/Makefile.objs
    A authz/pamacct.c
    M authz/trace-events
    M configure
    A include/authz/pamacct.h
    M qemu-options.hx
    M tests/Makefile.include
    A tests/test-authz-pam.c

  Log Message:
  -----------
  authz: add QAuthZPAM object type for authorizing using PAM

Add an authorization backend that talks to PAM to check whether the user
identity is allowed. This only uses the PAM account validation facility,
which is essentially just a check to see if the provided username is permitted
access. It doesn't use the authentication or session parts of PAM, since
that's dealt with by the relevant part of QEMU (eg VNC server).

Consider starting QEMU with a VNC server and telling it to use TLS with
x509 client certificates and configuring it to use an PAM to validate
the x509 distinguished name. In this example we're telling it to use PAM
for the QAuthZ impl with a service name of "qemu-vnc"

 $ qemu-system-x86_64 \
     -object tls-creds-x509,id=tls0,dir=/home/berrange/security/qemutls,\
             endpoint=server,verify-peer=yes \
     -object authz-pam,id=authz0,service=qemu-vnc \
     -vnc :1,tls-creds=tls0,tls-authz=authz0

This requires an /etc/pam/qemu-vnc file to be created with the auth
rules. A very simple file based whitelist can be setup using

  $ cat > /etc/pam/qemu-vnc <<EOF
  account         requisite       pam_listfile.so item=user sense=allow 
file=/etc/qemu/vnc.allow
  EOF

The /etc/qemu/vnc.allow file simply contains one username per line. Any
username not in the file is denied. The usernames in this example are
the x509 distinguished name from the client's x509 cert.

  $ cat > /etc/qemu/vnc.allow <<EOF
  CN=laptop.berrange.com,O=Berrange Home,L=London,ST=London,C=GB
  EOF

More interesting would be to configure PAM to use an LDAP backend, so
that the QEMU authorization check data can be centralized instead of
requiring each compute host to have file maintained.

The main limitation with this PAM module is that the rules apply to all
QEMU instances on the host. Setting up different rules per VM, would
require creating a separate PAM service name & config file for every
guest. An alternative approach for the future might be to not pass in
the plain username to PAM, but instead combine the VM name or UUID with
the username. This requires further consideration though.

Tested-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>


  Commit: b76806d4ec5c55d36bf5508f1405d132a4b862de
      
https://github.com/qemu/qemu/commit/b76806d4ec5c55d36bf5508f1405d132a4b862de
  Author: Daniel P. Berrange <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M configure
    M crypto/tlssession.c
    M crypto/trace-events
    R include/qemu/acl.h
    M monitor.c
    M tests/Makefile.include
    M tests/test-crypto-tlssession.c
    M tests/test-io-channel-tls.c
    M ui/vnc-auth-sasl.c
    M ui/vnc-auth-sasl.h
    M ui/vnc-auth-vencrypt.c
    M ui/vnc-ws.c
    M ui/vnc.c
    M ui/vnc.h
    M util/Makefile.objs
    R util/acl.c

  Log Message:
  -----------
  authz: delete existing ACL implementation

The 'qemu_acl' type was a previous non-QOM based attempt to provide an
authorization facility in QEMU. Because it is non-QOM based it cannot be
created via the command line and requires special monitor commands to
manipulate it.

The new QAuthZ subclasses provide a superset of the functionality in
qemu_acl, so the latter can now be deleted. The HMP 'acl_*' monitor
commands are converted to use the new QAuthZSimple data type instead
in order to provide temporary backwards compatibility.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>


  Commit: 86c7e2f4a93322a76afea5ee6806a83420d1dfea
      
https://github.com/qemu/qemu/commit/86c7e2f4a93322a76afea5ee6806a83420d1dfea
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-26 (Tue, 26 Feb 2019)

  Changed paths:
    M MAINTAINERS
    M Makefile
    M Makefile.objs
    M Makefile.target
    A authz/Makefile.objs
    A authz/base.c
    A authz/list.c
    A authz/listfile.c
    A authz/pamacct.c
    A authz/simple.c
    A authz/trace-events
    M configure
    M crypto/tlssession.c
    M crypto/trace-events
    M hw/usb/dev-mtp.c
    M hw/usb/trace-events
    A include/authz/base.h
    A include/authz/list.h
    A include/authz/listfile.h
    A include/authz/pamacct.h
    A include/authz/simple.h
    R include/qemu/acl.h
    A include/qemu/filemonitor.h
    M monitor.c
    M qapi/Makefile.objs
    A qapi/authz.json
    M qapi/qapi-schema.json
    M qemu-options.hx
    M qom/object.c
    M qom/object_interfaces.c
    M tests/Makefile.include
    A tests/test-authz-list.c
    A tests/test-authz-listfile.c
    A tests/test-authz-pam.c
    A tests/test-authz-simple.c
    M tests/test-crypto-tlssession.c
    M tests/test-io-channel-tls.c
    A tests/test-util-filemonitor.c
    M ui/vnc-auth-sasl.c
    M ui/vnc-auth-sasl.h
    M ui/vnc-auth-vencrypt.c
    M ui/vnc-ws.c
    M ui/vnc.c
    M ui/vnc.h
    M util/Makefile.objs
    R util/acl.c
    A util/filemonitor-inotify.c
    A util/filemonitor-stub.c
    M util/trace-events

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/berrange/tags/authz-core-pull-request' 
into staging

Add a standard authorization framework

The current network services now support encryption via TLS and in some
cases support authentication via SASL. In cases where SASL is not
available, x509 client certificates can be used as a crude authorization
scheme, but using a sub-CA and controlling who you give certs to. In
general this is not very flexible though, so this series introduces a
new standard authorization framework.

It comes with four initial authorization mechanisms

 - Simple - an exact username match. This is useful when there is
   exactly one user that is known to connect. For example when live
   migrating from one QEMU to another with TLS, libvirt would use
   the simple scheme to whitelist the TLS cert of the source QEMU.

 - List - an full access control list, with optional regex matching.
   This is more flexible and is used to provide 100% backcompat with
   the existing HMP ACL commands. The caveat is that we can't create
   these via the CLI -object arg yet.

 - ListFile - the same as List, but with the rules stored in JSON
   format in an external file. This avoids the -object limitation
   while also allowing the admin to change list entries on the file.
   QEMU uses inotify to notice these changes and auto-reload the
   file contents. This is likely a good default choice for most
   network services, if the "simple" mechanism isn't sufficient.

 - PAM - delegate the username lookup to a PAM module, which opens
   the door to many options including things like SQL/LDAP lookups.

# gpg: Signature made Tue 26 Feb 2019 15:33:46 GMT
# gpg:                using RSA key BE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <address@hidden>" [full]
# gpg:                 aka "Daniel P. Berrange <address@hidden>" [full]
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E  8E3F BE86 EBB4 1510 4FDF

* remotes/berrange/tags/authz-core-pull-request:
  authz: delete existing ACL implementation
  authz: add QAuthZPAM object type for authorizing using PAM
  authz: add QAuthZListFile object type for a file access control list
  authz: add QAuthZList object type for an access control list
  authz: add QAuthZSimple object type for easy whitelist auth checks
  authz: add QAuthZ object as an authorization base class
  hw/usb: switch MTP to use new inotify APIs
  hw/usb: fix const-ness for string params in MTP driver
  hw/usb: don't set IN_ISDIR for inotify watch in MTP driver
  qom: don't require user creatable objects to be registered
  util: add helper APIs for dealing with inotify in portable manner

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/d88d85f1f062...86c7e2f4a933