qemu-e2k/ui
Daniel P. Berrange 55cf09a02b vnc: allow specifying a custom authorization object name
The VNC server has historically had support for ACLs to check both the
SASL username and the TLS x509 distinguished name. The VNC server was
responsible for creating the initial ACL, and the client app was then
responsible for populating it with rules using the HMP 'acl_add' command.

This is not satisfactory for a variety of reasons. There is no way to
populate the ACLs from the command line, users are forced to use the
HMP. With multiple network services all supporting TLS and ACLs now, it
is desirable to be able to define a single ACL that is referenced by all
services.

To address these limitations, two new options are added to the VNC
server CLI. The 'tls-authz' option takes the ID of a QAuthZ object to
use for checking TLS x509 distinguished names, and the 'sasl-authz'
option takes the ID of another object to use for checking SASL usernames.

In this example, we setup two authorization rules. The first allows any
client with a certificate issued by the 'RedHat' organization in the
'London' locality. The second ACL allows clients with either the
'joe@REDHAT.COM' or  'fred@REDHAT.COM' kerberos usernames. Both checks
must pass for the user to be allowed.

    $QEMU -object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
                  endpoint=server,verify-peer=yes \
          -object authz-simple,id=authz0,policy=deny,\
                  rules.0.match=O=RedHat,,L=London,rules.0.policy=allow \
          -object authz-simple,id=authz1,policy=deny,\
                  rules.0.match=fred@REDHAT.COM,rules.0.policy=allow \
                  rules.0.match=joe@REDHAT.COM,rules.0.policy=allow \
          -vnc 0.0.0.0:1,tls-creds=tls0,tls-authz=authz0,
	       sasl,sasl-authz=authz1 \
          ...other QEMU args...

Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20190227145755.26556-2-berrange@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-03-11 08:39:02 +01:00
..
icons ui: install logo icons to $prefix/share/icons 2019-01-21 09:43:13 +01:00
keycodemapdb@6b3d716e2b ui: update keycodemapdb to get py3 fixes 2018-02-05 19:53:55 -02:00
shader opengl: add flipping vertex shader 2017-10-17 10:25:42 +02:00
cocoa.m ui/cocoa: Perform UI operations only on the main thread 2019-03-04 16:47:31 +00:00
console-gl.c ui: use QEMU_IS_ALIGNED macro 2017-11-10 14:27:29 +01:00
console.c qemu/queue.h: simplify reverse access to QTAILQ 2019-01-11 15:46:55 +01:00
curses_keys.h curses: support wide input 2019-03-11 08:39:02 +01:00
curses.c curses: support wide input 2019-03-11 08:39:02 +01:00
cursor_hidden.xpm ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
cursor_left_ptr.xpm ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
cursor.c qxl: support mono cursors with inverted colors 2018-09-27 08:10:07 +02:00
egl-context.c Add gles support to egl-helpers, wire up in egl-headless and gtk. 2018-06-26 13:48:49 +02:00
egl-headless.c ui/egl-helpers: Augment parameter list of egl_texture_blend() to convey scales of viewport 2019-02-05 10:45:44 +01:00
egl-helpers.c ui/egl-helpers: Augment parameter list of egl_texture_blend() to convey scales of viewport 2019-02-05 10:45:44 +01:00
gtk-egl.c ui/egl-helpers: Augment parameter list of egl_texture_blend() to convey scales of viewport 2019-02-05 10:45:44 +01:00
gtk-gl-area.c ui: opengl updates for dma-buf support. 2017-10-19 12:09:53 +01:00
gtk.c ui/gtk: Fix the license information 2019-02-21 11:45:19 +01:00
input-keymap.c ui: darwin: gtk: Add missing input keymap 2018-06-14 09:52:23 +02:00
input-legacy.c ui: use local path for local headers 2018-06-01 19:20:38 +03:00
input-linux.c input-linux: customizable grab toggle keys 2019-01-24 10:42:38 +01:00
input.c input: avoid malloc for mouse events 2019-01-14 11:04:35 +00:00
kbd-state.c kbd-state: don't block auto-repeat events 2019-02-21 10:13:19 +01:00
keymaps.c keymap: fix keyup mappings 2019-02-05 10:45:44 +01:00
keymaps.h keymap: fix keyup mappings 2019-02-05 10:45:44 +01:00
Makefile.objs display: add -display spice-app launching a Spice client 2019-02-22 07:42:59 +01:00
qemu-pixman.c avoid TABs in files that only contain a few 2019-01-11 15:46:56 +01:00
qemu-x509.h ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
qemu.desktop ui: fix icon display for GTK frontend under GNOME Shell with Wayland 2019-01-21 09:43:13 +01:00
sdl2-2d.c sdl2: Support all virtio-gpu formats 2018-10-12 14:46:24 +02:00
sdl2-gl.c sdl2: redraw correctly when scanout_mode enabled. 2018-08-24 08:40:10 +02:00
sdl2-input.c sdl2: drop qemu_input_event_send_key_qcode call 2019-02-21 10:43:10 +01:00
sdl2.c kbd-state: use state tracker for sdl2 2019-02-05 10:45:44 +01:00
shader.c opengl: add flipping vertex shader 2017-10-17 10:25:42 +02:00
spice-app.c display: add -display spice-app launching a Spice client 2019-02-22 07:42:59 +01:00
spice-core.c spice: use a default name for the server 2019-02-21 14:09:17 +01:00
spice-display.c spice: set device address and device display ID in QXL interface 2019-02-21 10:15:26 +01:00
spice-input.c ui: use local path for local headers 2018-06-01 19:20:38 +03:00
trace-events console: minimal hotplug suport 2018-03-13 11:17:29 -06:00
vgafont.h ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
vnc_keysym.h ui: add next and prior keysyms 2017-07-27 14:23:09 +02:00
vnc-auth-sasl.c authz: delete existing ACL implementation 2019-02-26 15:32:19 +00:00
vnc-auth-sasl.h authz: delete existing ACL implementation 2019-02-26 15:32:19 +00:00
vnc-auth-vencrypt.c authz: delete existing ACL implementation 2019-02-26 15:32:19 +00:00
vnc-auth-vencrypt.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
vnc-enc-hextile-template.h ui: vnc: finish removing TABs 2019-02-05 16:50:18 +01:00
vnc-enc-hextile.c ui: Clean up includes 2016-02-04 17:01:04 +00:00
vnc-enc-tight.c ui/vnc: Remove useless parenthesis around DIV_ROUND_UP macro 2018-08-24 08:40:11 +02:00
vnc-enc-tight.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
vnc-enc-zlib.c ui: Clean up includes 2016-02-04 17:01:04 +00:00
vnc-enc-zrle.c rename included C files to foo.inc.c, remove osdep.h 2018-05-11 14:33:40 +02:00
vnc-enc-zrle.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
vnc-enc-zrle.inc.c rename included C files to foo.inc.c, remove osdep.h 2018-05-11 14:33:40 +02:00
vnc-enc-zywrle-template.c avoid TABs in files that only contain a few 2019-01-11 15:46:56 +01:00
vnc-enc-zywrle.h ui: vnc: finish removing TABs 2019-02-05 16:50:18 +01:00
vnc-jobs.c vnc: fix memleak of the "vnc-worker-output" name 2018-08-24 08:40:10 +02:00
vnc-jobs.h ui/vnc: Drop unused vnc_has_job() and vnc_jobs_clear() 2017-02-08 14:59:36 +01:00
vnc-palette.c all: Remove unnecessary glib.h includes 2016-06-07 18:19:24 +03:00
vnc-palette.h Include qapi/qmp/qlist.h exactly where needed 2018-02-09 13:52:15 +01:00
vnc-stubs.c vnc: add qapi/error.h include to stubs 2018-02-16 12:23:21 +01:00
vnc-ws.c authz: delete existing ACL implementation 2019-02-26 15:32:19 +00:00
vnc-ws.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
vnc.c vnc: allow specifying a custom authorization object name 2019-03-11 08:39:02 +01:00
vnc.h authz: delete existing ACL implementation 2019-02-26 15:32:19 +00:00
x_keymap.c ui: fix keymap detection under Xwayland 2018-04-10 11:21:54 +02:00
x_keymap.h ui: convert GTK and SDL1 frontends to keycodemapdb 2018-01-25 15:02:00 +01:00