External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-06 09:55:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: remove use of the term 'whitelist' from cgroup docs

Browse Source 
The term "access control list" better describes the concept involved.

Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2020-06-16 11:24:48 +01:00
parent 11fc562951
commit 60e4d9d04e
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
docs/drvqemu.html.in
View File

@ -468,12 +468,12 @@ chmod o+x /path/to/directory
for resource management. It is implemented via a number of "controllers",
each controller covering a specific task/functional area. One of the
available controllers is the "devices" controller, which is able to
setup whitelists of block/character devices that a cgroup should be
allowed to access. If the "devices" controller is mounted on a host,
then libvirt will automatically create a dedicated cgroup for each
QEMU virtual machine and setup the device whitelist so that the QEMU
process can only access shared devices, and explicitly disks images
backed by block devices.
setup access control lists of block/character devices that a cgroup
should be allowed to access. If the "devices" controller is mounted on a
host, then libvirt will automatically create a dedicated cgroup for each
QEMU virtual machine and setup the device access control list so that the
QEMU process can only access shared devices, and explicitly assigned disks
images backed by block devices.
</p>
<p>

3
docs/kbase/qemu-passthrough-security.rst
View File

@ -110,7 +110,8 @@ Granting access per VM
policy on a per VM basis.
* Cgroups - a custom cgroup is created per VM and this will either use the
``devices`` controller or an ``BPF`` rule to whitelist a set of device nodes.
``devices`` controller or an ``BPF`` rule to define an access control list
for the set of device nodes.
There is no way to change this policy on a per VM basis.
Disabling security protection per VM