aboutsummaryrefslogtreecommitdiff
path: root/include/authz/pamacct.h
blob: f3a7ef10118e994206a11e22d4ff85e6e505987b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
/*
 * QEMU PAM authorization driver
 *
 * Copyright (c) 2018 Red Hat, Inc.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 *
 */

#ifndef QAUTHZ_PAMACCT_H
#define QAUTHZ_PAMACCT_H

#include "authz/base.h"


#define TYPE_QAUTHZ_PAM "authz-pam"

#define QAUTHZ_PAM_CLASS(klass) \
     OBJECT_CLASS_CHECK(QAuthZPAMClass, (klass), \
                        TYPE_QAUTHZ_PAM)
#define QAUTHZ_PAM_GET_CLASS(obj) \
     OBJECT_GET_CLASS(QAuthZPAMClass, (obj), \
                      TYPE_QAUTHZ_PAM)
#define QAUTHZ_PAM(obj) \
     OBJECT_CHECK(QAuthZPAM, (obj), \
                  TYPE_QAUTHZ_PAM)

typedef struct QAuthZPAM QAuthZPAM;
typedef struct QAuthZPAMClass QAuthZPAMClass;


/**
 * QAuthZPAM:
 *
 * This authorization driver provides a PAM mechanism
 * for granting access by matching user names against a
 * list of globs. Each match rule has an associated policy
 * and a catch all policy applies if no rule matches
 *
 * To create an instance of this class via QMP:
 *
 *  {
 *    "execute": "object-add",
 *    "arguments": {
 *      "qom-type": "authz-pam",
 *      "id": "authz0",
 *      "parameters": {
 *        "service": "qemu-vnc-tls"
 *      }
 *    }
 *  }
 *
 * The driver only uses the PAM "account" verification
 * subsystem. The above config would require a config
 * file /etc/pam.d/qemu-vnc-tls. For a simple file
 * lookup it would contain
 *
 *   account requisite  pam_listfile.so item=user sense=allow \
 *           file=/etc/qemu/vnc.allow
 *
 * The external file would then contain a list of usernames.
 * If x509 cert was being used as the username, a suitable
 * entry would match the distinguish name:
 *
 *  CN=laptop.berrange.com,O=Berrange Home,L=London,ST=London,C=GB
 *
 * On the command line it can be created using
 *
 *   -object authz-pam,id=authz0,service=qemu-vnc-tls
 *
 */
struct QAuthZPAM {
    QAuthZ parent_obj;

    char *service;
};


struct QAuthZPAMClass {
    QAuthZClass parent_class;
};


QAuthZPAM *qauthz_pam_new(const char *id,
                          const char *service,
                          Error **errp);

#endif /* QAUTHZ_PAMACCT_H */