mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-11-02 11:21:12 +00:00
0f01192e7e
For the sake of backwards compat, LXC guests are *not* confined by default. This is because it is not practical to dynamically relabel containers using large filesystem trees. Applications can create confined containers though, by giving suitable XML configs * src/Makefile.am: Link libvirt_lxc to security drivers * src/lxc/libvirtd_lxc.aug, src/lxc/lxc_conf.h, src/lxc/lxc_conf.c, src/lxc/lxc.conf, src/lxc/test_libvirtd_lxc.aug: Config file handling for security driver * src/lxc/lxc_driver.c: Wire up security driver functions * src/lxc/lxc_controller.c: Add a '--security' flag to specify which security driver to activate * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Set the process label just before exec'ing init.
34 lines
1.4 KiB
Plaintext
34 lines
1.4 KiB
Plaintext
module Test_libvirtd_lxc =
|
|
|
|
let conf = "# Master configuration file for the LXC driver.
|
|
# All settings described here are optional - if omitted, sensible
|
|
# defaults are used.
|
|
|
|
# By default, log messages generated by the lxc controller go to the
|
|
# container logfile. It is also possible to accumulate log messages
|
|
# from all lxc controllers along with libvirtd's log outputs. In this
|
|
# case, the lxc controller will honor either LIBVIRT_LOG_OUTPUTS or
|
|
# log_outputs from libvirtd.conf.
|
|
#
|
|
# This is disabled by default, uncomment below to enable it.
|
|
#
|
|
log_with_libvirtd = 1
|
|
security_driver = \"selinux\"
|
|
"
|
|
|
|
test Libvirtd_lxc.lns get conf =
|
|
{ "#comment" = "Master configuration file for the LXC driver." }
|
|
{ "#comment" = "All settings described here are optional - if omitted, sensible" }
|
|
{ "#comment" = "defaults are used." }
|
|
{ "#empty" }
|
|
{ "#comment" = "By default, log messages generated by the lxc controller go to the" }
|
|
{ "#comment" = "container logfile. It is also possible to accumulate log messages" }
|
|
{ "#comment" = "from all lxc controllers along with libvirtd's log outputs. In this" }
|
|
{ "#comment" = "case, the lxc controller will honor either LIBVIRT_LOG_OUTPUTS or" }
|
|
{ "#comment" = "log_outputs from libvirtd.conf." }
|
|
{ "#comment" = "" }
|
|
{ "#comment" = "This is disabled by default, uncomment below to enable it." }
|
|
{ "#comment" = "" }
|
|
{ "log_with_libvirtd" = "1" }
|
|
{ "security_driver" = "selinux" }
|