Skip to content

L
libvirt

openeuler / libvirt

通知 3
Star 0
Fork 0
L
libvirt

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
查找文件 普通视图历史永久链接Permalink
aclpolkit.html.in 16.0 KB
Newer Older
D
Add documentation for access control system  
Daniel P. Berrange 已提交
1 
<?xml version="1.0" encoding="UTF-8"?>
D
docs: switch to using HTML5 doctype declaration  
Daniel P. Berrange 已提交
2 
<!DOCTYPE html>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
3 4 5 6 7 8 9 10 11 12 13 14 15 16 
<html xmlns="http://www.w3.org/1999/xhtml">
  <body>
    <h1>Polkit access control</h1>

    <p>
      Libvirt's client <a href="acl.html">access control framework</a> allows
      administrators to setup fine grained permission rules across client users,
      managed objects and API operations. This allows client connections
      to be locked down to a minimal set of privileges. The polkit driver
      provides a simple implementation of the access control framework.
    </p>

    <ul id="toc"></ul>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
17 
    <h2><a id="intro">Introduction</a></h2>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
18 19 20 21 22 23 24 25 26 27 28 29 

    <p>
      A default install of libvirt will typically use
      <a href="http://www.freedesktop.org/wiki/Software/polkit/">polkit</a>
      to authenticate the initial user connection to libvirtd. This is a
      very coarse grained check though, either allowing full read-write
      access to all APIs, or just read-only access. The polkit access
      control driver in libvirt builds on this capability to allow for
      fine grained control over the operations a user may perform on an
      object.
    </p>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
30 
    <h2><a id="perms">Permission names</a></h2>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 

    <p>
      The libvirt <a href="acl.html#perms">object names and permission names</a>
      are mapped onto polkit action names using the simple pattern:
    </p>

    <pre>org.libvirt.api.$object.$permission
</pre>

    <p>
      The only caveat is that any underscore characters in the
      object or permission names are converted to hyphens. So,
      for example, the <code>search_storage_vols</code> permission
      on the <code>storage_pool</code> object maps to the polkit
      action:
    </p>
    <pre>org.libvirt.api.storage-pool.search-storage-vols
</pre>

    <p>
      The default policy for any permission which corresponds to
      a "read only" operation, is to allow access. All other
      permissions default to deny access.
    </p>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
56 
    <h2><a id="attrs">Object identity attributes</a></h2>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
57 58 59 60 61 62 63 64 65 

    <p>
      To allow polkit authorization rules to be written to match
      against individual object instances, libvirt provides a number
      of authorization detail attributes when performing a permission
      check. The set of attributes varies according to the type
      of object being checked
    </p>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
66 
    <h3><a id="object_connect">virConnectPtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
82 
    <h3><a id="object_domain">virDomainPtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>domain_name</td>
          <td>Name of the domain, unique to the local host</td>
        </tr>
        <tr>
          <td>domain_uuid</td>
          <td>UUID of the domain, globally unique</td>
        </tr>
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
106 
    <h3><a id="object_interface">virInterfacePtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>interface_name</td>
          <td>Name of the network interface, unique to the local host</td>
        </tr>
        <tr>
L
doc: fix mismatched ACL attribute name  
Luyao Huang 已提交
124 
          <td>interface_macaddr</td>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
125 126 127 128 129 
          <td>MAC address of the network interface, not unique</td>
        </tr>
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
130 
    <h3><a id="object_network">virNetworkPtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>network_name</td>
          <td>Name of the network, unique to the local host</td>
        </tr>
        <tr>
          <td>network_uuid</td>
          <td>UUID of the network, globally unique</td>
        </tr>
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
154 
    <h3><a id="object_node_device">virNodeDevicePtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>node_device_name</td>
          <td>Name of the node device, unique to the local host</td>
        </tr>
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
174 
    <h3><a id="object_nwfilter">virNWFilterPtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>nwfilter_name</td>
          <td>Name of the network filter, unique to the local host</td>
        </tr>
        <tr>
          <td>nwfilter_uuid</td>
          <td>UUID of the network filter, globally unique</td>
        </tr>
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
198 
    <h3><a id="object_secret">virSecretPtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>secret_uuid</td>
          <td>UUID of the secret, globally unique</td>
        </tr>
        <tr>
          <td>secret_usage_volume</td>
          <td>Name of the associated volume, if any</td>
        </tr>
        <tr>
          <td>secret_usage_ceph</td>
          <td>Name of the associated Ceph server, if any</td>
        </tr>
        <tr>
          <td>secret_usage_target</td>
          <td>Name of the associated iSCSI target, if any</td>
        </tr>
J
conf: Add new secret type "tls"  
John Ferlan 已提交
227 228 229 230 
        <tr>
          <td>secret_usage_name</td>
          <td>Name of the associated TLS secret, if any</td>
        </tr>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
231 232 233 
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
234 
    <h3><a id="object_storage_pool">virStoragePoolPtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>pool_name</td>
          <td>Name of the storage pool, unique to the local host</td>
        </tr>
        <tr>
          <td>pool_uuid</td>
          <td>UUID of the storage pool, globally unique</td>
        </tr>
      </tbody>
    </table>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
258 
    <h3><a id="object_storage_vol">virStorageVolPtr</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 
    <table class="acl">
      <thead>
        <tr>
          <th>Attribute</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>connect_driver</td>
          <td>Name of the libvirt connection driver</td>
        </tr>
        <tr>
          <td>pool_name</td>
          <td>Name of the storage pool, unique to the local host</td>
        </tr>
        <tr>
          <td>pool_uuid</td>
          <td>UUID of the storage pool, globally unique</td>
        </tr>
        <tr>
          <td>vol_name</td>
          <td>Name of the storage volume, unique to the pool</td>
        </tr>
        <tr>
          <td>vol_key</td>
          <td>Key of the storage volume, globally unique</td>
        </tr>
      </tbody>
    </table>
J
docs: Enhance polkit documentation to describe secondary connection  
John Ferlan 已提交
290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 
    <h2><a id="connect_driver">Hypervisor Driver connect_driver</a></h2>
    <p>
      The <code>connect_driver</code> parameter describes the
      client's <a href="remote.html">remote Connection Driver</a>
      name based on the <a href="uri.html">URI</a> used for the
      connection.
    </p>
    <p>
      <span class="since">Since 4.1.0</span>, when calling an API
      outside the scope of the primary connection driver, the
      primary driver will attempt to open a secondary connection
      to the specific API driver in order to process the API. For
      example, when hypervisor domain processing needs to make an
      API call within the storage driver or the network filter driver
      an attempt to open a connection to the "storage" or "nwfilter"
      driver will be made. Similarly, a "storage" primary connection
      may need to create a connection to the "secret" driver in order
      to process secrets for the API. If successful, then calls to
      those API's will occur in the <code>connect_driver</code> context
      of the secondary connection driver rather than in the context of
      the primary driver. This affects the <code>connect_driver</code>
      returned from rule generation from the <code>action.loookup</code>
      function. The following table provides a list of the various
      connection drivers and the <code>connect_driver</code> name
      used by each regardless of primary or secondary connection.
      The access denied error message from libvirt will list the
      connection driver by name that denied the access.
    </p>

    <h3><a id="object_connect_driver">Connection Driver Name</a></h3>
    <table class="acl">
      <thead>
        <tr>
          <th>Connection Driver</th>
          <th><code>connect_driver</code> name</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td>bhyve</td>
          <td>bhyve</td>
        </tr>
        <tr>
          <td>esx</td>
          <td>ESX</td>
        </tr>
        <tr>
          <td>hyperv</td>
          <td>Hyper-V</td>
        </tr>
        <tr>
          <td>interface</td>
          <td>interface</td>
        </tr>
        <tr>
          <td>libxl</td>
          <td>xenlight</td>
        </tr>
        <tr>
          <td>lxc</td>
          <td>LXC</td>
        </tr>
        <tr>
          <td>network</td>
          <td>network</td>
        </tr>
        <tr>
          <td>nodedev</td>
          <td>nodedev</td>
        </tr>
        <tr>
          <td>nwfilter</td>
          <td>NWFilter</td>
        </tr>
        <tr>
          <td>openvz</td>
          <td>OPENVZ</td>
        </tr>
        <tr>
          <td>phyp</td>
          <td>PHYP</td>
        </tr>
        <tr>
          <td>qemu</td>
          <td>QEMU</td>
        </tr>
        <tr>
          <td>secret</td>
          <td>secret</td>
        </tr>
        <tr>
          <td>storage</td>
          <td>storage</td>
        </tr>
        <tr>
          <td>vbox</td>
          <td>VBOX</td>
        </tr>
        <tr>
          <td>vmware</td>
          <td>VMWARE</td>
        </tr>
        <tr>
          <td>vz</td>
          <td>vz</td>
        </tr>
      </tbody>
    </table>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
399
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
400 
    <h2><a id="user">User identity attributes</a></h2>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 

    <p>
      At this point in time, the only attribute provided by
      libvirt to identify the user invoking the operation
      is the PID of the client program. This means that the
      polkit access control driver is only useful if connections
      to libvirt are restricted to its UNIX domain socket. If
      connections are being made to a TCP socket, no identifying
      information is available and access will be denied.
      Also note that if the client is connecting via an SSH
      tunnel, it is the local SSH user that will be identified.
      In future versions, it is expected that more information
      about the client user will be provided, including the
      SASL / Kerberos username and/or x509 distinguished
      name obtained from the authentication provider in use.
    </p>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
419 
    <h2><a id="checks">Writing access control policies</a></h2>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 

    <p>
      If using versions of polkit prior to 0.106 then it is only
      possible to validate (user, permission) pairs via the <code>.pkla</code>
      files. Fully validation of the (user, permission, object) triple
      requires the new JavaScript <code>.rules</code> support that
      was introduced in version 0.106. The latter is what will be
      described here.
    </p>

    <p>
      Libvirt does not ship any rules files by default. It merely
      provides a definition of the default behaviour for each
      action (permission). As noted earlier, permissions which
      correspond to read-only operations in libvirt will be allowed
      to all users by default; everything else is denied by default.
      Defining custom rules requires creation of a file in the
      <code>/etc/polkit-1/rules.d</code> directory with a name
      chosen by the administrator (<code>100-libvirt-acl.rules</code>
      would be a reasonable choice). See the <code>polkit(8)</code>
      manual page for a description of how to write these files
      in general. The key idea is to create a file containing
      something like
    </p>

    <pre>
M
aclpolkit.html.in: Kill useless spaces in <pre/>  
Michal Privoznik 已提交
446 447 448 
polkit.addRule(function(action, subject) {
  ....logic to check 'action' and 'subject'...
});
D
Add documentation for access control system  
Daniel P. Berrange 已提交
449 450 451 452 453 454 455 456 457 458 459 
    </pre>

    <p>
      In this code snippet above, the <code>action</code> object
      instance will represent the libvirt permission being checked
      along with identifying attributes for the object it is being
      applied to. The <code>subject</code> meanwhile will identify
      the libvirt client app (with the caveat above about it only
      dealing with local clients connected via the UNIX socket).
      On the <code>action</code> object, the permission name is
      accessible via the <code>id</code> attribute, while the
D
Update polkit examples to use 'lookup' method  
Daniel P. Berrange 已提交
460 461 
      object identifying attributes are exposed via the
      <code>lookup</code> method.
D
Add documentation for access control system  
Daniel P. Berrange 已提交
462 463 
    </p>
J
examples: Add example polkit ACL rules  
Jiri Denemark 已提交
464 465 
    <p>
    See
D
Use https:// links for most sites  
Daniel P. Berrange 已提交
466 
    <a href="https://libvirt.org/git/?p=libvirt.git;a=tree;f=examples/polkit;hb=HEAD">source code</a>
J
examples: Add example polkit ACL rules  
Jiri Denemark 已提交
467 468 469 
    for a more complex example.
    </p>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
470 
    <h3><a id="exconnect">Example: restricting ability to connect to drivers</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
471 472 473 474 475 476 477 478 

    <p>
      Consider a local user <code>berrange</code>
      who has been granted permission to connect to libvirt in
      full read-write mode. The goal is to only allow them to
      use the <code>QEMU</code> driver and not the Xen or LXC
      drivers which are also available in libvirtd.
      To achieve this we need to write a rule which checks
D
Update polkit examples to use 'lookup' method  
Daniel P. Berrange 已提交
479 
      whether the <code>connect_driver</code> attribute
D
Add documentation for access control system  
Daniel P. Berrange 已提交
480 481 482 483 484 485 486 487 488 
      is <code>QEMU</code>, and match on an action
      name of <code>org.libvirt.api.connect.getattr</code>. Using
      the javascript rules format, this ends up written as
    </p>

    <pre>
polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.api.connect.getattr" &amp;&amp;
        subject.user == "berrange") {
D
Update polkit examples to use 'lookup' method  
Daniel P. Berrange 已提交
489 
          if (action.lookup("connect_driver") == 'QEMU') {
D
Add documentation for access control system  
Daniel P. Berrange 已提交
490 491 492 493 494 495 496 497 
            return polkit.Result.YES;
          } else {
            return polkit.Result.NO;
          }
    }
});
    </pre>
D
docs: switch to using 'id' attribute instead of 'name' for links  
Daniel P. Berrange 已提交
498 
    <h3><a id="exdomain">Example: restricting access to a single domain</a></h3>
D
Add documentation for access control system  
Daniel P. Berrange 已提交
499 500 501 502 503 504 505 

    <p>
      Consider a local user <code>berrange</code>
      who has been granted permission to connect to libvirt in
      full read-write mode. The goal is to only allow them to
      see the domain called <code>demo</code> on the LXC driver.
      To achieve this we need to write a rule which checks
D
Update polkit examples to use 'lookup' method  
Daniel P. Berrange 已提交
506 507 
      whether the <code>connect_driver</code> attribute
      is <code>LXC</code> and the <code>domain_name</code>
V
docs: Grammar and spelling fixes  
Ville Skyttä 已提交
508 
      attribute is <code>demo</code>, and match on an action
D
Add documentation for access control system  
Daniel P. Berrange 已提交
509 510 511 512 513 514 515 516 
      name of <code>org.libvirt.api.domain.getattr</code>. Using
      the javascript rules format, this ends up written as
    </p>

    <pre>
polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.api.domain.getattr" &amp;&amp;
        subject.user == "berrange") {
D
Update polkit examples to use 'lookup' method  
Daniel P. Berrange 已提交
517 518 
          if (action.lookup("connect_driver") == 'LXC' &amp;&amp;
              action.lookup("domain_name") == 'demo') {
D
Add documentation for access control system  
Daniel P. Berrange 已提交
519 520 521 522 523 524 525 526 527 
            return polkit.Result.YES;
          } else {
            return polkit.Result.NO;
          }
    }
});
    </pre>
  </body>
</html>