libvirt/src/lxc/lxc.conf

# Master configuration file for the LXC driver.
# All settings described here are optional - if omitted, sensible
# defaults are used.

# By default, log messages generated by the lxc controller go to the
# container logfile. It is also possible to accumulate log messages
# from all lxc controllers along with libvirtd's log outputs. In this
# case, the lxc controller will honor either LIBVIRT_LOG_OUTPUTS or
# log_outputs from libvirtd.conf.
#
# This is disabled by default, uncomment below to enable it.
#
#log_with_libvirtd = 1


# The default security driver is SELinux. If SELinux is disabled
# on the host, then the security driver will automatically disable
# itself. If you wish to disable LXC SELinux security driver while
# leaving SELinux enabled for the host in general, then set this
# to 'none' instead.
#
#security_driver = "selinux"

# If set to non-zero, then the default security labeling
# will make guests confined. If set to zero, then guests
# will be unconfined by default. Defaults to 0.
#security_default_confined = 1

# If set to non-zero, then attempts to create unconfined
# guests will be blocked. Defaults to 0.
#security_require_confined = 1
LXC add driver config file lxc.conf * src/lxc/lxc.conf: new configuration file, there is currently one tunable "log_with_libvirtd" that controls whether an lxc controller will log only to the container log file, or whether it will honor libvirtd's log output configuration. This provides a way to have libvirtd and its children log to a single file. The default is to log to the container log file. * src/Makefile.am libvirt.spec.in: add the new file * src/lxc/lxc_conf.[ch] src/lxc/lxc_driver.c: read the new log value from the configuration file and pass the log informations when starting up a container. 2009-10-08 15:40:14 +00:00			`# Master configuration file for the LXC driver.`
			`# All settings described here are optional - if omitted, sensible`
			`# defaults are used.`

			`# By default, log messages generated by the lxc controller go to the`
			`# container logfile. It is also possible to accumulate log messages`
			`# from all lxc controllers along with libvirtd's log outputs. In this`
			`# case, the lxc controller will honor either LIBVIRT_LOG_OUTPUTS or`
			`# log_outputs from libvirtd.conf.`
			`#`
			`# This is disabled by default, uncomment below to enable it.`
			`#`
Standardize whitespace used in example config files Instead of doing # example_config use #example_config so it is possible to programatically uncomment example config options, as distinct from their comment/descriptions Also delete rogue trailing comma not allowed by lens Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2012-05-25 09:32:17 +00:00			`#log_with_libvirtd = 1`
Add support for sVirt in the LXC driver For the sake of backwards compat, LXC guests are not confined by default. This is because it is not practical to dynamically relabel containers using large filesystem trees. Applications can create confined containers though, by giving suitable XML configs * src/Makefile.am: Link libvirt_lxc to security drivers * src/lxc/libvirtd_lxc.aug, src/lxc/lxc_conf.h, src/lxc/lxc_conf.c, src/lxc/lxc.conf, src/lxc/test_libvirtd_lxc.aug: Config file handling for security driver * src/lxc/lxc_driver.c: Wire up security driver functions * src/lxc/lxc_controller.c: Add a '--security' flag to specify which security driver to activate * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Set the process label just before exec'ing init. 2012-01-25 14:12:53 +00:00

			`# The default security driver is SELinux. If SELinux is disabled`
			`# on the host, then the security driver will automatically disable`
lxc.conf: s/QEMU/LXC/ There's one copy paste error where a comment mentions QEMU instead of LXC driver. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> 2016-11-09 17:13:45 +00:00			`# itself. If you wish to disable LXC SELinux security driver while`
Add support for sVirt in the LXC driver For the sake of backwards compat, LXC guests are not confined by default. This is because it is not practical to dynamically relabel containers using large filesystem trees. Applications can create confined containers though, by giving suitable XML configs * src/Makefile.am: Link libvirt_lxc to security drivers * src/lxc/libvirtd_lxc.aug, src/lxc/lxc_conf.h, src/lxc/lxc_conf.c, src/lxc/lxc.conf, src/lxc/test_libvirtd_lxc.aug: Config file handling for security driver * src/lxc/lxc_driver.c: Wire up security driver functions * src/lxc/lxc_controller.c: Add a '--security' flag to specify which security driver to activate * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Set the process label just before exec'ing init. 2012-01-25 14:12:53 +00:00			`# leaving SELinux enabled for the host in general, then set this`
			`# to 'none' instead.`
			`#`
Standardize whitespace used in example config files Instead of doing # example_config use #example_config so it is possible to programatically uncomment example config options, as distinct from their comment/descriptions Also delete rogue trailing comma not allowed by lens Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2012-05-25 09:32:17 +00:00			`#security_driver = "selinux"`
Add support for sVirt in the LXC driver For the sake of backwards compat, LXC guests are not confined by default. This is because it is not practical to dynamically relabel containers using large filesystem trees. Applications can create confined containers though, by giving suitable XML configs * src/Makefile.am: Link libvirt_lxc to security drivers * src/lxc/libvirtd_lxc.aug, src/lxc/lxc_conf.h, src/lxc/lxc_conf.c, src/lxc/lxc.conf, src/lxc/test_libvirtd_lxc.aug: Config file handling for security driver * src/lxc/lxc_driver.c: Wire up security driver functions * src/lxc/lxc_controller.c: Add a '--security' flag to specify which security driver to activate * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Set the process label just before exec'ing init. 2012-01-25 14:12:53 +00:00
			`# If set to non-zero, then the default security labeling`
			`# will make guests confined. If set to zero, then guests`
			`# will be unconfined by default. Defaults to 0.`
Standardize whitespace used in example config files Instead of doing # example_config use #example_config so it is possible to programatically uncomment example config options, as distinct from their comment/descriptions Also delete rogue trailing comma not allowed by lens Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2012-05-25 09:32:17 +00:00			`#security_default_confined = 1`
Add support for sVirt in the LXC driver For the sake of backwards compat, LXC guests are not confined by default. This is because it is not practical to dynamically relabel containers using large filesystem trees. Applications can create confined containers though, by giving suitable XML configs * src/Makefile.am: Link libvirt_lxc to security drivers * src/lxc/libvirtd_lxc.aug, src/lxc/lxc_conf.h, src/lxc/lxc_conf.c, src/lxc/lxc.conf, src/lxc/test_libvirtd_lxc.aug: Config file handling for security driver * src/lxc/lxc_driver.c: Wire up security driver functions * src/lxc/lxc_controller.c: Add a '--security' flag to specify which security driver to activate * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Set the process label just before exec'ing init. 2012-01-25 14:12:53 +00:00
			`# If set to non-zero, then attempts to create unconfined`
			`# guests will be blocked. Defaults to 0.`
Standardize whitespace used in example config files Instead of doing # example_config use #example_config so it is possible to programatically uncomment example config options, as distinct from their comment/descriptions Also delete rogue trailing comma not allowed by lens Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2012-05-25 09:32:17 +00:00			`#security_require_confined = 1`