qemu/tests/test-authz-list.c

161 lines
5.9 KiB
C
Raw Normal View History

authz: add QAuthZList object type for an access control list Add a QAuthZList object type that implements the QAuthZ interface. This built-in implementation maintains a trivial access control list with a sequence of match rules and a final default policy. This replicates the functionality currently provided by the qemu_acl module. To create an instance of this object via the QMP monitor, the syntax used would be: { "execute": "object-add", "arguments": { "qom-type": "authz-list", "id": "authz0", "props": { "rules": [ { "match": "fred", "policy": "allow", "format": "exact" }, { "match": "bob", "policy": "allow", "format": "exact" }, { "match": "danb", "policy": "deny", "format": "glob" }, { "match": "dan*", "policy": "allow", "format": "exact" }, ], "policy": "deny" } } } This sets up an authorization rule that allows 'fred', 'bob' and anyone whose name starts with 'dan', except for 'danb'. Everyone unmatched is denied. It is not currently possible to create this via -object, since there is no syntax supported to specify non-scalar properties for objects. This is likely to be addressed by later support for using JSON with -object, or an equivalent approach. In any case the future "authz-listfile" object can be used from the CLI and is likely a better choice, as it allows the ACL to be refreshed automatically on change. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-10-21 16:54:59 +03:00
/*
* QEMU list file authorization object tests
*
* Copyright (c) 2018 Red Hat, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
authz: add QAuthZList object type for an access control list Add a QAuthZList object type that implements the QAuthZ interface. This built-in implementation maintains a trivial access control list with a sequence of match rules and a final default policy. This replicates the functionality currently provided by the qemu_acl module. To create an instance of this object via the QMP monitor, the syntax used would be: { "execute": "object-add", "arguments": { "qom-type": "authz-list", "id": "authz0", "props": { "rules": [ { "match": "fred", "policy": "allow", "format": "exact" }, { "match": "bob", "policy": "allow", "format": "exact" }, { "match": "danb", "policy": "deny", "format": "glob" }, { "match": "dan*", "policy": "allow", "format": "exact" }, ], "policy": "deny" } } } This sets up an authorization rule that allows 'fred', 'bob' and anyone whose name starts with 'dan', except for 'danb'. Everyone unmatched is denied. It is not currently possible to create this via -object, since there is no syntax supported to specify non-scalar properties for objects. This is likely to be addressed by later support for using JSON with -object, or an equivalent approach. In any case the future "authz-listfile" object can be used from the CLI and is likely a better choice, as it allows the ACL to be refreshed automatically on change. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-10-21 16:54:59 +03:00
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
*
*/
#include "qemu/osdep.h"
#include "authz/list.h"
#include "qemu/module.h"
authz: add QAuthZList object type for an access control list Add a QAuthZList object type that implements the QAuthZ interface. This built-in implementation maintains a trivial access control list with a sequence of match rules and a final default policy. This replicates the functionality currently provided by the qemu_acl module. To create an instance of this object via the QMP monitor, the syntax used would be: { "execute": "object-add", "arguments": { "qom-type": "authz-list", "id": "authz0", "props": { "rules": [ { "match": "fred", "policy": "allow", "format": "exact" }, { "match": "bob", "policy": "allow", "format": "exact" }, { "match": "danb", "policy": "deny", "format": "glob" }, { "match": "dan*", "policy": "allow", "format": "exact" }, ], "policy": "deny" } } } This sets up an authorization rule that allows 'fred', 'bob' and anyone whose name starts with 'dan', except for 'danb'. Everyone unmatched is denied. It is not currently possible to create this via -object, since there is no syntax supported to specify non-scalar properties for objects. This is likely to be addressed by later support for using JSON with -object, or an equivalent approach. In any case the future "authz-listfile" object can be used from the CLI and is likely a better choice, as it allows the ACL to be refreshed automatically on change. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-10-21 16:54:59 +03:00
static void test_authz_default_deny(void)
{
QAuthZList *auth = qauthz_list_new("auth0",
QAUTHZ_LIST_POLICY_DENY,
&error_abort);
g_assert(!qauthz_is_allowed(QAUTHZ(auth), "fred", &error_abort));
object_unparent(OBJECT(auth));
}
static void test_authz_default_allow(void)
{
QAuthZList *auth = qauthz_list_new("auth0",
QAUTHZ_LIST_POLICY_ALLOW,
&error_abort);
g_assert(qauthz_is_allowed(QAUTHZ(auth), "fred", &error_abort));
object_unparent(OBJECT(auth));
}
static void test_authz_explicit_deny(void)
{
QAuthZList *auth = qauthz_list_new("auth0",
QAUTHZ_LIST_POLICY_ALLOW,
&error_abort);
qauthz_list_append_rule(auth, "fred", QAUTHZ_LIST_POLICY_DENY,
QAUTHZ_LIST_FORMAT_EXACT, &error_abort);
g_assert(!qauthz_is_allowed(QAUTHZ(auth), "fred", &error_abort));
object_unparent(OBJECT(auth));
}
static void test_authz_explicit_allow(void)
{
QAuthZList *auth = qauthz_list_new("auth0",
QAUTHZ_LIST_POLICY_DENY,
&error_abort);
qauthz_list_append_rule(auth, "fred", QAUTHZ_LIST_POLICY_ALLOW,
QAUTHZ_LIST_FORMAT_EXACT, &error_abort);
g_assert(qauthz_is_allowed(QAUTHZ(auth), "fred", &error_abort));
object_unparent(OBJECT(auth));
}
static void test_authz_complex(void)
{
QAuthZList *auth = qauthz_list_new("auth0",
QAUTHZ_LIST_POLICY_DENY,
&error_abort);
qauthz_list_append_rule(auth, "fred", QAUTHZ_LIST_POLICY_ALLOW,
QAUTHZ_LIST_FORMAT_EXACT, &error_abort);
qauthz_list_append_rule(auth, "bob", QAUTHZ_LIST_POLICY_ALLOW,
QAUTHZ_LIST_FORMAT_EXACT, &error_abort);
qauthz_list_append_rule(auth, "dan", QAUTHZ_LIST_POLICY_DENY,
QAUTHZ_LIST_FORMAT_EXACT, &error_abort);
qauthz_list_append_rule(auth, "dan*", QAUTHZ_LIST_POLICY_ALLOW,
QAUTHZ_LIST_FORMAT_GLOB, &error_abort);
g_assert(qauthz_is_allowed(QAUTHZ(auth), "fred", &error_abort));
g_assert(qauthz_is_allowed(QAUTHZ(auth), "bob", &error_abort));
g_assert(!qauthz_is_allowed(QAUTHZ(auth), "dan", &error_abort));
g_assert(qauthz_is_allowed(QAUTHZ(auth), "danb", &error_abort));
object_unparent(OBJECT(auth));
}
static void test_authz_add_remove(void)
{
QAuthZList *auth = qauthz_list_new("auth0",
QAUTHZ_LIST_POLICY_ALLOW,
&error_abort);
g_assert_cmpint(qauthz_list_append_rule(auth, "fred",
QAUTHZ_LIST_POLICY_ALLOW,
QAUTHZ_LIST_FORMAT_EXACT,
&error_abort),
==, 0);
g_assert_cmpint(qauthz_list_append_rule(auth, "bob",
QAUTHZ_LIST_POLICY_ALLOW,
QAUTHZ_LIST_FORMAT_EXACT,
&error_abort),
==, 1);
g_assert_cmpint(qauthz_list_append_rule(auth, "dan",
QAUTHZ_LIST_POLICY_DENY,
QAUTHZ_LIST_FORMAT_EXACT,
&error_abort),
==, 2);
g_assert_cmpint(qauthz_list_append_rule(auth, "frank",
QAUTHZ_LIST_POLICY_DENY,
QAUTHZ_LIST_FORMAT_EXACT,
&error_abort),
==, 3);
g_assert(!qauthz_is_allowed(QAUTHZ(auth), "dan", &error_abort));
g_assert_cmpint(qauthz_list_delete_rule(auth, "dan"),
==, 2);
g_assert(qauthz_is_allowed(QAUTHZ(auth), "dan", &error_abort));
g_assert_cmpint(qauthz_list_insert_rule(auth, "dan",
QAUTHZ_LIST_POLICY_DENY,
QAUTHZ_LIST_FORMAT_EXACT,
2,
&error_abort),
==, 2);
g_assert(!qauthz_is_allowed(QAUTHZ(auth), "dan", &error_abort));
object_unparent(OBJECT(auth));
}
int main(int argc, char **argv)
{
g_test_init(&argc, &argv, NULL);
module_call_init(MODULE_INIT_QOM);
g_test_add_func("/auth/list/default/deny", test_authz_default_deny);
g_test_add_func("/auth/list/default/allow", test_authz_default_allow);
g_test_add_func("/auth/list/explicit/deny", test_authz_explicit_deny);
g_test_add_func("/auth/list/explicit/allow", test_authz_explicit_allow);
g_test_add_func("/auth/list/complex", test_authz_complex);
g_test_add_func("/auth/list/add-remove", test_authz_add_remove);
return g_test_run();
}