commit 50d4bd48c5d9aa64fdca2002f88197f0d24ad825
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Sat Oct 19 13:19:42 2013 -0600
libvirt ACLs
en-US/Virtualization.xml | 18 ++++++++++++++++++
1 files changed, 18 insertions(+), 0 deletions(-)
---
diff --git a/en-US/Virtualization.xml b/en-US/Virtualization.xml
index d72dd21..c781b3a 100644
--- a/en-US/Virtualization.xml
+++ b/en-US/Virtualization.xml
@@ -22,6 +22,24 @@
</title>
<para />
-->
+<section id="virtualization-libvirt-acl">
+ <title>Libvirt Client Access Control</title>
+ <para>
+ The <application>libvirt</application> client allows for the setting of
permission rules which can be applied to all managed objects and API operations, thus
allowing for all client connections to be limited to a minimal set of rules and
privileges. There are three levels of access which can be assigned.
+ </para>
+ <para>
+ <literal>Unauthenticated</literal> access is initially used for all
connections. This state allows all API operations that are required to complete
authentication. Following a successful authentication, two more levels can be assigned:
<literal>Unrestricted</literal>, which gives full access to all API
operations, and <literal>Restricted</literal>, which allows read only access.
+ </para>
+ <para>
+ System administrators can set permission rules for authenticated connections. Every
API call in libvirt has a set of permissions that are validated against the object that is
being used. For example, User A wants to change a parameter in the domain object. When the
user tries to save the change, virDomainSetSchedulerParametersFlags method will check
whether the client has write permissions on the domain object. Additional checks and
permission settings can be processed as well. Filtering can also be done to see which
clients have permissions on which objects to allow for smother administration of
permissions.
+ </para>
+ <para>
+ The libvirtd.conf configuration file is responsible for setting the access
permissions. It uses the access_drivers parameter to enable this operation. Note that if
more than one access driver is requested, all must succeed in order for permission to be
granted.
+ </para>
+ <para>
+ More information can be found at <ulink
url="https://fedoraproject.org/wiki/Changes/Virt_ACLs" /> and <ulink
url="http://libvirt.org/acl.html" />
+ </para>
+</section>
<section id="virtualization-snapshopts">
<title>Virt-manager snapshots</title>