Git-Mirrors/qusal
1
0
Fork 0
mirror of https://github.com/ben-grande/qusal.git synced 2024-10-01 02:35:49 -04:00
Code Issues Packages Projects Releases Wiki Activity

feat: allow print calls from qubes with tag

Browse Source 
Fixes: https://github.com/ben-grande/qusal/issues/63
This commit is contained in:
Ben Grande 2024-06-20 10:40:58 +02:00
parent 97b2496891
commit ab56b5f3c8
No known key found for this signature in database
GPG Key ID: 00C64E14F51F9E56
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
salt/sys-print/README.md
View File

@ -74,20 +74,26 @@ qvm-features QUBE service.print-setup 1
## Access Control
_Default policy_: `ask` `all` requests requesting to use the
`qusal.Print` RPC service.
**_Default policy_** (qusal.Print RPC service):
- Clients with tag `print-client` are `allowed` to call servers with tag
`print-server`, defaulting to `sys-print`.
- `All` clients can `ask` servers with tag `print-server`, defaulting to
`sys-print`.
`Asking` can spawn multiple requests depending on the client, usage of `allow`
is recommended for trusted clients.
Allow access to the specified printing agent based on the qube tag:
```qrexecpolicy
qusal.Print * @tag:print-client @default allow target=sys-print
Add the tag `print-client` to the qube requesting the print content:
```sh
qvm-tags QUBE add print-client
```
Always recommended to end with an explicit deny rule:
As the call will default to `sys-print`, you can enforce the use of
`disp-sys-print` via policy and not any other qube:
```qrexecpolicy
qusal.Print * @anyvm @anyvm deny
qusal.Print * @tag:print-client @default allow target=disp-sys-print
qusal.Print * @tag:print-client @anyvm deny
```
## Usage

2
salt/sys-print/files/admin/policy/default.policy
View File

@ -4,6 +4,8 @@
## Do not modify this file, create a new policy with with a lower number in the
## file name instead. For example `30-user.policy`.
qusal.Print * @tag:print-client @tag:print-server allow
qusal.Print * @tag:print-client @default allow target=sys-print
qusal.Print * @anyvm @tag:print-server ask
qusal.Print * @anyvm @default ask default_target=sys-print
qusal.Print * @anyvm @anyvm deny