[libvirt] [PATCHv3 1/3] lxc: allow to keep or drop capabilities
Daniel P. Berrange
berrange at redhat.com
Thu Jun 26 09:42:46 UTC 2014
On Thu, Jun 26, 2014 at 10:40:27AM +0200, Cédric Bosdonnat wrote:
> Added <capabilities> in the <features> section of LXC domains
> configuration. This section can contain elements named after the
> capabilities like:
>
> <mknod state="on"/>, keep CAP_MKNOD capability
> <sys_chroot state="off"/> drop CAP_SYS_CHROOT capability
>
> Users can restrict or give more capabilities than the default using
> this mechanism.
> ---
> docs/schemas/domaincommon.rng | 207 ++++++++++++++++++++
> src/conf/domain_conf.c | 126 ++++++++++++-
> src/conf/domain_conf.h | 56 ++++++
> src/libvirt_private.syms | 3 +
> src/lxc/lxc_cgroup.c | 8 +
> src/lxc/lxc_container.c | 241 ++++++++++++++++++++++--
> src/util/vircgroup.c | 74 +++++++-
> src/util/vircgroup.h | 2 +
> tests/domainschemadata/domain-caps-features.xml | 28 +++
> 9 files changed, 720 insertions(+), 25 deletions(-)
> create mode 100644 tests/domainschemadata/domain-caps-features.xml
ACK
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
More information about the libvir-list
mailing list