2008-09-04 10:44:23 +00:00
|
|
|
(* /etc/libvirt/qemu.conf *)
|
|
|
|
|
|
|
|
module Libvirtd_qemu =
|
|
|
|
autoload xfm
|
|
|
|
|
|
|
|
let eol = del /[ \t]*\n/ "\n"
|
|
|
|
let value_sep = del /[ \t]*=[ \t]*/ " = "
|
|
|
|
let indent = del /[ \t]*/ ""
|
|
|
|
|
|
|
|
let array_sep = del /,[ \t\n]*/ ", "
|
|
|
|
let array_start = del /\[[ \t\n]*/ "[ "
|
|
|
|
let array_end = del /\]/ "]"
|
|
|
|
|
|
|
|
let str_val = del /\"/ "\"" . store /[^\"]*/ . del /\"/ "\""
|
|
|
|
let bool_val = store /0|1/
|
2011-04-05 12:17:28 +00:00
|
|
|
let int_val = store /[0-9]+/
|
2008-09-04 10:44:23 +00:00
|
|
|
let str_array_element = [ seq "el" . str_val ] . del /[ \t\n]*/ ""
|
|
|
|
let str_array_val = counter "el" . array_start . ( str_array_element . ( array_sep . str_array_element ) * ) ? . array_end
|
|
|
|
|
|
|
|
let str_entry (kw:string) = [ key kw . value_sep . str_val ]
|
|
|
|
let bool_entry (kw:string) = [ key kw . value_sep . bool_val ]
|
2011-04-05 12:17:28 +00:00
|
|
|
let int_entry (kw:string) = [ key kw . value_sep . int_val ]
|
2008-09-04 10:44:23 +00:00
|
|
|
let str_array_entry (kw:string) = [ key kw . value_sep . str_array_val ]
|
|
|
|
|
|
|
|
|
|
|
|
(* Config entry grouped by function - same order as example config *)
|
|
|
|
let vnc_entry = str_entry "vnc_listen"
|
2011-01-28 20:52:20 +00:00
|
|
|
| bool_entry "vnc_auto_unix_socket"
|
2008-09-04 10:44:23 +00:00
|
|
|
| bool_entry "vnc_tls"
|
|
|
|
| str_entry "vnc_tls_x509_cert_dir"
|
|
|
|
| bool_entry "vnc_tls_x509_verify"
|
2009-01-29 17:50:00 +00:00
|
|
|
| str_entry "vnc_password"
|
2009-03-16 13:54:26 +00:00
|
|
|
| bool_entry "vnc_sasl"
|
|
|
|
| str_entry "vnc_sasl_dir"
|
2012-05-25 10:20:43 +00:00
|
|
|
| bool_entry "vnc_allow_host_audio"
|
|
|
|
|
|
|
|
let spice_entry = str_entry "spice_listen"
|
2012-05-24 19:04:47 +00:00
|
|
|
| bool_entry "spice_tls"
|
|
|
|
| str_entry "spice_tls_x509_cert_dir"
|
2012-05-25 10:18:24 +00:00
|
|
|
| str_entry "spice_password"
|
2012-02-24 14:13:06 +00:00
|
|
|
| bool_entry "spice_sasl"
|
|
|
|
| str_entry "spice_sasl_dir"
|
2012-05-25 10:20:43 +00:00
|
|
|
|
2013-08-17 19:30:47 +00:00
|
|
|
let nogfx_entry = bool_entry "nographics_allow_host_audio"
|
|
|
|
|
2012-06-18 08:22:07 +00:00
|
|
|
let remote_display_entry = int_entry "remote_display_port_min"
|
|
|
|
| int_entry "remote_display_port_max"
|
2013-04-30 14:26:43 +00:00
|
|
|
| int_entry "remote_websocket_port_min"
|
|
|
|
| int_entry "remote_websocket_port_max"
|
2012-06-18 08:22:07 +00:00
|
|
|
|
2012-05-25 10:20:43 +00:00
|
|
|
let security_entry = str_entry "security_driver"
|
Add two new security label types
Curently security labels can be of type 'dynamic' or 'static'.
If no security label is given, then 'dynamic' is assumed. The
current code takes advantage of this default, and avoids even
saving <seclabel> elements with type='dynamic' to disk. This
means if you temporarily change security driver, the guests
can all still start.
With the introduction of sVirt to LXC though, there needs to be
a new default of 'none' to allow unconfined LXC containers.
This patch introduces two new security label types
- default: the host configuration decides whether to run the
guest with type 'none' or 'dynamic' at guest start
- none: the guest will run unconfined by security policy
The 'none' label type will obviously be undesirable for some
deployments, so a new qemu.conf option allows a host admin to
mandate confined guests. It is also possible to turn off default
confinement
security_default_confined = 1|0 (default == 1)
security_require_confined = 1|0 (default == 0)
* src/conf/domain_conf.c, src/conf/domain_conf.h: Add new
seclabel types
* src/security/security_manager.c, src/security/security_manager.h:
Set default sec label types
* src/security/security_selinux.c: Handle 'none' seclabel type
* src/qemu/qemu.conf, src/qemu/qemu_conf.c, src/qemu/qemu_conf.h,
src/qemu/libvirtd_qemu.aug: New security config options
* src/qemu/qemu_driver.c: Tell security driver about default
config
2012-01-25 14:12:52 +00:00
|
|
|
| bool_entry "security_default_confined"
|
|
|
|
| bool_entry "security_require_confined"
|
2009-07-15 21:25:01 +00:00
|
|
|
| str_entry "user"
|
|
|
|
| str_entry "group"
|
2010-10-20 08:25:05 +00:00
|
|
|
| bool_entry "dynamic_ownership"
|
2009-07-22 15:08:04 +00:00
|
|
|
| str_array_entry "cgroup_controllers"
|
|
|
|
| str_array_entry "cgroup_device_acl"
|
2012-09-17 07:59:53 +00:00
|
|
|
| int_entry "seccomp_sandbox"
|
2012-05-25 10:20:43 +00:00
|
|
|
|
|
|
|
let save_entry = str_entry "save_image_format"
|
2010-10-28 07:31:46 +00:00
|
|
|
| str_entry "dump_image_format"
|
2013-10-09 16:05:43 +00:00
|
|
|
| str_entry "snapshot_image_format"
|
2010-12-08 06:19:17 +00:00
|
|
|
| str_entry "auto_dump_path"
|
2011-07-19 21:54:48 +00:00
|
|
|
| bool_entry "auto_dump_bypass_cache"
|
|
|
|
| bool_entry "auto_start_bypass_cache"
|
2012-05-25 10:20:43 +00:00
|
|
|
|
|
|
|
let process_entry = str_entry "hugetlbfs_mount"
|
2010-05-27 23:17:55 +00:00
|
|
|
| bool_entry "clear_emulator_capabilities"
|
2013-03-25 14:25:30 +00:00
|
|
|
| str_entry "bridge_helper"
|
2010-10-20 08:25:05 +00:00
|
|
|
| bool_entry "set_process_name"
|
2011-04-05 12:17:28 +00:00
|
|
|
| int_entry "max_processes"
|
2011-12-22 11:22:31 +00:00
|
|
|
| int_entry "max_files"
|
2012-05-25 10:20:43 +00:00
|
|
|
|
|
|
|
let device_entry = bool_entry "mac_filter"
|
|
|
|
| bool_entry "relaxed_acs_check"
|
|
|
|
| bool_entry "allow_disk_format_probing"
|
2010-10-26 14:04:46 +00:00
|
|
|
| str_entry "lock_manager"
|
2012-05-25 10:20:43 +00:00
|
|
|
|
|
|
|
let rpc_entry = int_entry "max_queued"
|
2011-09-16 11:50:56 +00:00
|
|
|
| int_entry "keepalive_interval"
|
|
|
|
| int_entry "keepalive_count"
|
2008-09-04 10:44:23 +00:00
|
|
|
|
2013-10-09 09:32:55 +00:00
|
|
|
let network_entry = str_entry "migration_address"
|
2013-10-18 16:28:14 +00:00
|
|
|
| int_entry "migration_port_min"
|
|
|
|
| int_entry "migration_port_max"
|
2014-05-20 06:08:05 +00:00
|
|
|
| str_entry "migration_host"
|
2013-10-09 09:32:55 +00:00
|
|
|
|
2014-04-09 13:23:45 +00:00
|
|
|
let log_entry = bool_entry "log_timestamp"
|
|
|
|
|
2014-08-07 14:59:21 +00:00
|
|
|
let nvram_entry = str_array_entry "nvram"
|
|
|
|
|
2013-04-30 14:28:20 +00:00
|
|
|
(* Each entry in the config is one of the following ... *)
|
2008-09-04 10:44:23 +00:00
|
|
|
let entry = vnc_entry
|
2012-05-25 10:20:43 +00:00
|
|
|
| spice_entry
|
2013-08-17 19:30:47 +00:00
|
|
|
| nogfx_entry
|
2012-06-18 08:22:07 +00:00
|
|
|
| remote_display_entry
|
2012-05-25 10:20:43 +00:00
|
|
|
| security_entry
|
|
|
|
| save_entry
|
|
|
|
| process_entry
|
|
|
|
| device_entry
|
|
|
|
| rpc_entry
|
2013-10-09 09:32:55 +00:00
|
|
|
| network_entry
|
2014-04-09 13:23:45 +00:00
|
|
|
| log_entry
|
2014-08-07 14:59:21 +00:00
|
|
|
| nvram_entry
|
2012-05-25 10:20:43 +00:00
|
|
|
|
2008-09-04 10:44:23 +00:00
|
|
|
let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ]
|
|
|
|
let empty = [ label "#empty" . eol ]
|
|
|
|
|
|
|
|
let record = indent . entry . eol
|
|
|
|
|
|
|
|
let lns = ( record | comment | empty ) *
|
|
|
|
|
|
|
|
let filter = incl "/etc/libvirt/qemu.conf"
|
|
|
|
. Util.stdexcl
|
|
|
|
|
|
|
|
let xfm = transform lns filter
|