From Fedora Project Wiki
(Replace content with link to test case)
 
(3 intermediate revisions by 3 users not shown)
Line 31: Line 31:
CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
-->
-->
* Tracker bug: <will be assigned by the Wrangler>
* Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=998507 #998507]


== Detailed Description ==
== Detailed Description ==
Line 42: Line 42:


* Proposal owners:
* Proposal owners:
# 90% of the work is already in rawhide
# 100% of the work is already in rawhide
# Documentation needs to be written
# Documentation is written


* Other developers: N/A (not a System Wide Change)
* Other developers: N/A (not a System Wide Change)
Line 53: Line 53:


== How To Test ==
== How To Test ==
<!-- N/A (not a System Wide Change) -->


1. As root, create two KVM guests named 'apache' and 'mysql' using virt-install
See the test case at: https://fedoraproject.org/wiki/QA:Testcase_Virt_ACLs
2. As a non-root user 'fred', run
 
  virsh -c qemu:///system list --all'
 
Note that 'fred' can see both VMs
 
3. As root, create a file  /etc/polkit-1/rules.d/100-libvirt-api.rules containing
 
  polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.api.domain.getattr" &&
        subject.user == "freq") {
          if (action._detail_connect_driver == 'QEMU' &&
              action._detail_domain_name == 'apache') {
            return polkit.Result.YES;
          } else {
            return polkit.Result.NO;
          }
    }
  });
 
4. As a non-root user 'fred' run
 
virsh -c qemu:///system list --all'
 
Note that 'fred' can now only see the 'apache' VM.
 
The same kind of rules can be applied to storage pools, volumes, networks, and more.


== User Experience ==
== User Experience ==
Line 100: Line 72:
* General docs on access control system http://libvirt.org/acl.html
* General docs on access control system http://libvirt.org/acl.html
* Polkit driver usage / config http://libvirt.org/aclpolkit.html
* Polkit driver usage / config http://libvirt.org/aclpolkit.html
* XXX: should blog about this when ready
* https://fedoraproject.org/wiki/QA:Testcase_Virt_ACLs


== Release Notes ==
== Release Notes ==

Latest revision as of 18:16, 4 October 2013

Role based access control with libvirt

Summary

Allow role based access control with libvirt.

Owner

Current status

Detailed Description

Libvirt role based access control will allow fine grained access control like 'user FOO can only start/stop/pause vm BAR', but for all libvirt APIs and objects.

Benefit to Fedora

  • Nice, new, oft requested feature is finally available that we can advertise for Fedora 20.

Scope

  • Proposal owners:
  1. 100% of the work is already in rawhide
  2. Documentation is written
  • Other developers: N/A (not a System Wide Change)
  • Release engineering: N/A (not a System Wide Change)
  • Policies and guidelines: N/A (not a System Wide Change)

Upgrade/compatibility impact

N/A (not a System Wide Change)

How To Test

See the test case at: https://fedoraproject.org/wiki/QA:Testcase_Virt_ACLs

User Experience

N/A (not a System Wide Change)

Dependencies

N/A (not a System Wide Change)

Contingency Plan

  • Contingency mechanism: N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change)

Documentation

Release Notes

Libvirt now supports role based access control, which allows setting rules such as 'user FOO can only start/stop/pause vm BAR'.

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/Virt_ACLs&oldid=355571"