Daniel P. Berrange b170eb99f5 Add two new security label types ... Curently security labels can be of type 'dynamic' or 'static'. If no security label is given, then 'dynamic' is assumed. The current code takes advantage of this default, and avoids even saving <seclabel> elements with type='dynamic' to disk. This means if you temporarily change security driver, the guests can all still start. With the introduction of sVirt to LXC though, there needs to be a new default of 'none' to allow unconfined LXC containers. This patch introduces two new security label types - default: the host configuration decides whether to run the guest with type 'none' or 'dynamic' at guest start - none: the guest will run unconfined by security policy The 'none' label type will obviously be undesirable for some deployments, so a new qemu.conf option allows a host admin to mandate confined guests. It is also possible to turn off default confinement security_default_confined = 1|0 (default == 1) security_require_confined = 1|0 (default == 0) * src/conf/domain_conf.c, src/conf/domain_conf.h: Add new seclabel types * src/security/security_manager.c, src/security/security_manager.h: Set default sec label types * src/security/security_selinux.c: Handle 'none' seclabel type * src/qemu/qemu.conf, src/qemu/qemu_conf.c, src/qemu/qemu_conf.h, src/qemu/libvirtd_qemu.aug: New security config options * src/qemu/qemu_driver.c: Tell security driver about default config		2012-02-02 17:44:37 -07:00
..
basictypes.rng	Use a common xml type for ceph secret usage.	2011-10-28 16:01:14 -06:00
capability.rng	Fix capabilities XML to use generic terms for suspend targets	2011-11-30 10:12:29 +00:00
domain.rng	snapshot: update rng to support full domain in xml	2011-09-03 08:12:13 -06:00
domaincommon.rng	Add two new security label types	2012-02-02 17:44:37 -07:00
domainsnapshot.rng	snapshot: also support disks by path	2011-09-05 07:03:04 -06:00
interface.rng	xml: create an RNG file for common types and move some definitions there	2011-07-05 12:33:21 -04:00
Makefile.am	snapshot: update rng to support full domain in xml	2011-09-03 08:12:13 -06:00
network.rng	Adding the element pf to network xml.	2012-01-11 13:10:21 -07:00
networkcommon.rng	Implement DNS SRV record into the bridge driver	2012-01-02 23:05:55 +08:00
nodedev.rng	npiv: Expose fabric_name outside	2011-12-07 18:42:08 +08:00
nwfilter.rng	Introduce possibility to have an iterator per variable	2012-01-11 06:42:37 -05:00
secret.rng	Use a common xml type for ceph secret usage.	2011-10-28 16:01:14 -06:00
storageencryption.rng	Remove accidentally added UUID re-definition in storage schema	2009-09-14 19:11:13 +01:00
storagepool.rng	Fix parsing of port attribute in storage XML configuration	2010-11-23 14:55:33 +00:00
storagevol.rng	maint: convert leading TABs in *.rng files to equivalent spaces	2010-03-01 20:19:20 +01:00