Archipelago » qemu

    { "acl", "sss?i?", do_acl, "<command> <aclname> [<match> [<index>]]\n",

                               "acl show vnc.username\n"

                               "acl policy vnc.username deny\n"

                               "acl allow vnc.username fred\n"

                               "acl deny vnc.username bob\n"

                               "acl reset vnc.username\n" },

@item acl @var{subcommand} @var{aclname} @var{match} @var{index}

Manage access control lists for network services. There are currently

two named access control lists, @var{vnc.x509dname} and @var{vnc.username}

matching on the x509 client certificate distinguished name, and SASL

username respectively.

@table @option

@item acl show <aclname>

list all the match rules in the access control list, and the default

policy

@item acl policy <aclname> @code{allow|deny}

set the default access control list policy, used in the event that

always @code{deny}

@item acl allow <aclname> <match> [<index>]

add a match to the access control list, allowing access. The match will

normally be an exact username or x509 distinguished name, but can

optionally include wildcard globs. eg @code{*@@EXAMPLE.COM} to allow

all users in the @code{EXAMPLE.COM} kerberos realm. The match will

normally be appended to the end of the ACL, but can be inserted

earlier in the list if the optional @code{index} parameter is supplied.

@item acl deny <aclname> <match> [<index>]

add a match to the access control list, denying access. The match will

normally be an exact username or x509 distinguished name, but can

optionally include wildcard globs. eg @code{*@@EXAMPLE.COM} to allow

all users in the @code{EXAMPLE.COM} kerberos realm. The match will

earlier in the list if the optional @code{index} parameter is supplied.

@item acl remove <aclname> <match>

remove the specified match rule from the access control list.

@item acl reset <aclname>

remove all matches from the access control list, and set the default

@end table