Re: [libvirt] Implementing VNC per VM access control lists
On Tue, 2011-01-04 at 16:22 +0000, Daniel P. Berrange wrote:
Well I'd like us to have fine grained access control across
users,
objects & operations, probably using the role based access control
model. Once you have such fine grained access control, then I
don't believe you have a clearcut boundary between users of libvirtd
and users of VNC. eg, you may well give the VNC admin access to the
'virDomainDestroy' and 'virDomainStart' commands for his own domains,
but not other people's domains. So I think we should think about the
solution to the authorization problem for both libvirtd & VNC at the
same time.
Have you got an RBAC library in mind that would take the group
management outside of libvirt (like SASL does for authentication), or
does it all need building?
Neil