)]}'
{
  "commit": "76655d6dece88bd00e190956e8e4285b682edcbb",
  "tree": "12e9365035a18d6a0bbfdfef0362999c9752a434",
  "parents": [
    "1263b7d6131cdaed2c460cf03757aaaf5696ec47"
  ],
  "author": {
    "name": "aliguori",
    "email": "aliguori@c046a42c-6fe2-441c-8c8c-71466251a162",
    "time": "Fri Mar 06 20:27:37 2009 +0000"
  },
  "committer": {
    "name": "aliguori",
    "email": "aliguori@c046a42c-6fe2-441c-8c8c-71466251a162",
    "time": "Fri Mar 06 20:27:37 2009 +0000"
  },
  "message": "Support ACLs for controlling VNC access (\"Daniel P. Berrange\")\n\nThis patch introduces a generic internal API for access control lists\nto be used by network servers in QEMU. It adds support for checking\nthese ACL in the VNC server, in two places. The first ACL is for the\nSASL authentication mechanism, checking the SASL username. This ACL\nis called \u0027vnc.username\u0027. The second is for the TLS authentication\nmechanism, when x509 client certificates are turned on, checking against\nthe Distinguished Name of the client. This ACL is called \u0027vnc.x509dname\u0027\n\nThe internal API provides for an ACL with the following characteristics\n\n - A unique name, eg  vnc.username, and vnc.x509dname.\n - A default policy, allow or deny\n - An ordered series of match rules, with allow or deny policy\n\nIf none of the match rules apply, then the default policy is\nused.\n\nThere is a monitor API to manipulate the ACLs, which I\u0027ll describe via\nexamples\n\n  (qemu) acl show vnc.username\n  policy: allow\n  (qemu) acl policy vnc.username denya\n  acl: policy set to \u0027deny\u0027\n  (qemu) acl allow vnc.username fred\n  acl: added rule at position 1\n  (qemu) acl allow vnc.username bob\n  acl: added rule at position 2\n  (qemu) acl allow vnc.username joe 1\n  acl: added rule at position 1\n  (qemu) acl show vnc.username\n  policy: deny\n  0: allow fred\n  1: allow joe\n  2: allow bob\n\n\n  (qemu) acl show vnc.x509dname\n  policy: allow\n  (qemu) acl policy vnc.x509dname deny\n  acl: policy set to \u0027deny\u0027\n  (qemu) acl allow vnc.x509dname C\u003dGB,O\u003dACME,L\u003dLondon,CN\u003d*\n  acl: added rule at position 1\n  (qemu) acl allow vnc.x509dname C\u003dGB,O\u003dACME,L\u003dBoston,CN\u003dbob\n  acl: added rule at position 2\n  (qemu) acl show vnc.x509dname\n  policy: deny\n  0: allow C\u003dGB,O\u003dACME,L\u003dLondon,CN\u003d*\n  1: allow C\u003dGB,O\u003dACME,L\u003dBoston,CN\u003dbob\n\nBy default the VNC server will not use any ACLs, allowing access to\nthe server if the user successfully authenticates. To enable use of\nACLs to restrict user access, the \u0027,acl\u0027 flag should be given when\nstarting QEMU. The initial ACL activated will be a \u0027deny all\u0027 policy\nand should be customized using monitor commands.\n\neg enable SASL auth and ACLs\n\n    qemu ....  -vnc localhost:1,sasl,acl\n\nThe next patch will provide a way to load a pre-defined ACL when\nstarting up\n\n\n Makefile        |    6 +\n b/acl.c         |  185 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n b/acl.h         |   74 ++++++++++++++++++++++\n configure       |   18 +++++\n monitor.c       |   95 ++++++++++++++++++++++++++++\n qemu-doc.texi   |   49 ++++++++++++++\n vnc-auth-sasl.c |   16 +++-\n vnc-auth-sasl.h |    7 ++\n vnc-tls.c       |   19 +++++\n vnc-tls.h       |    3 \n vnc.c           |   21 ++++++\n vnc.h           |    3 \n 12 files changed, 491 insertions(+), 5 deletions(-)\n\n   Signed-off-by: Daniel P. Berrange \u003cberrange@redhat.com\u003e\nSigned-off-by: Anthony Liguori \u003caliguori@us.ibm.com\u003e\n\n\ngit-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6726 c046a42c-6fe2-441c-8c8c-71466251a162\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e9a75c422f459cb2015cab2b74166c1a1d0a3137",
      "old_mode": 33188,
      "old_path": "Makefile",
      "new_id": "5506acc88c5cb3b974eb1190e7f0cdf7f9b47f0d",
      "new_mode": 33188,
      "new_path": "Makefile"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "173bf95b05e2cfa4b05e320bfcc18a6a3e95d9f8",
      "new_mode": 33188,
      "new_path": "acl.c"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "62a5e56409637e753d9ca71404b01162f9855686",
      "new_mode": 33188,
      "new_path": "acl.h"
    },
    {
      "type": "modify",
      "old_id": "5c2b15447fd1f97793ceca0ace4937012190eb58",
      "old_mode": 33261,
      "old_path": "configure",
      "new_id": "3823ee423e6fc52778b1a0339b9918c87be23bb9",
      "new_mode": 33261,
      "new_path": "configure"
    },
    {
      "type": "modify",
      "old_id": "85da2390b1887a93a8088abd0ecdad49d46c6e41",
      "old_mode": 33188,
      "old_path": "monitor.c",
      "new_id": "3d81fbc887c33c7e124d396b497499d6130e43ad",
      "new_mode": 33188,
      "new_path": "monitor.c"
    },
    {
      "type": "modify",
      "old_id": "1528f39cf499c4a8127dbbd3c0ae125c36b05ffa",
      "old_mode": 33188,
      "old_path": "qemu-doc.texi",
      "new_id": "6201932590b6956e26752638d159f95e37895c46",
      "new_mode": 33188,
      "new_path": "qemu-doc.texi"
    },
    {
      "type": "modify",
      "old_id": "2882a357d8963dc3fce8ef58bab4bf5106e2c92f",
      "old_mode": 33188,
      "old_path": "vnc-auth-sasl.c",
      "new_id": "4b4aca947521b33a628aeb63a846e777ac0472fd",
      "new_mode": 33188,
      "new_path": "vnc-auth-sasl.c"
    },
    {
      "type": "modify",
      "old_id": "a72973a26b2ec2f75cb625ab9d01cf3c468e46a8",
      "old_mode": 33188,
      "old_path": "vnc-auth-sasl.h",
      "new_id": "fd9b18a8fed620e80b37c85ba9c871bb671f8b72",
      "new_mode": 33188,
      "new_path": "vnc-auth-sasl.h"
    },
    {
      "type": "modify",
      "old_id": "b8d16d06704169ec741edf50e71c70cd338851b8",
      "old_mode": 33188,
      "old_path": "vnc.c",
      "new_id": "a57777a10afbe98731a6180fc4f0a2613a097334",
      "new_mode": 33188,
      "new_path": "vnc.c"
    },
    {
      "type": "modify",
      "old_id": "59a1b4ab9d3a80d0f93e33c6fd9e93e0f6bab1f5",
      "old_mode": 33188,
      "old_path": "vnc.h",
      "new_id": "8b6bc5e1289b512c756f7f8aa97ad64f292f991b",
      "new_mode": 33188,
      "new_path": "vnc.h"
    }
  ]
}