motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-05 00:33:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

ui, monitor: remove deprecated VNC ACL option and HMP commands

Browse source 
The VNC ACL concept has been replaced by the pluggable "authz" framework
which does not use monitor commands.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2021-02-19 17:47:31 +00:00
parent 571d413b5d
commit 5994dcb8d8
5 changed files with 12 additions and 317 deletions
Download patch file Download diff file Expand all files Collapse all files

76
hmp-commands.hx
View file

@ -1433,82 +1433,6 @@ SRST
Change watchdog action.
ERST
{
.name = "acl_show",
.args_type = "aclname:s",
.params = "aclname",
.help = "list rules in the access control list",
.cmd = hmp_acl_show,
},
SRST
``acl_show`` *aclname*
List all the matching rules in the access control list, and the default
policy. There are currently two named access control lists,
*vnc.x509dname* and *vnc.username* matching on the x509 client
certificate distinguished name, and SASL username respectively.
ERST
{
.name = "acl_policy",
.args_type = "aclname:s,policy:s",
.params = "aclname allow|deny",
.help = "set default access control list policy",
.cmd = hmp_acl_policy,
},
SRST
``acl_policy`` *aclname* ``allow|deny``
Set the default access control list policy, used in the event that
none of the explicit rules match. The default policy at startup is
always ``deny``.
ERST
{
.name = "acl_add",
.args_type = "aclname:s,match:s,policy:s,index:i?",
.params = "aclname match allow|deny [index]",
.help = "add a match rule to the access control list",
.cmd = hmp_acl_add,
},
SRST
``acl_add`` *aclname* *match* ``allow|deny`` [*index*]
Add a match rule to the access control list, allowing or denying access.
The match will normally be an exact username or x509 distinguished name,
but can optionally include wildcard globs. eg ``*@EXAMPLE.COM`` to
allow all users in the ``EXAMPLE.COM`` kerberos realm. The match will
normally be appended to the end of the ACL, but can be inserted
earlier in the list if the optional *index* parameter is supplied.
ERST
{
.name = "acl_remove",
.args_type = "aclname:s,match:s",
.params = "aclname match",
.help = "remove a match rule from the access control list",
.cmd = hmp_acl_remove,
},
SRST
``acl_remove`` *aclname* *match*
Remove the specified match rule from the access control list.
ERST
{
.name = "acl_reset",
.args_type = "aclname:s",
.params = "aclname",
.help = "reset the access control list",
.cmd = hmp_acl_reset,
},
SRST
``acl_reset`` *aclname*
Remove all matches from the access control list, and set the default
policy back to ``deny``.
ERST
{
.name = "nbd_server_start",
.args_type = "all:-a,writable:-w,uri:s",