[PATCH 1/4] conf: add XML schema for domain capabilities

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This patch introduces XML schema for domains to retain arbitrary capabilities.
For example, by adding the following XML to domain configuration, 
its domain can retain cap_sys_rawio capability.

...
  <domain_capabilities>
    <cap_sys_rawio/>
  </domain_capabilities>
...


Signed-off-by: Taku Izumi <izumi.taku@xxxxxxxxxxxxxx>
Signed-off-by: Shota Hirae <m11g1401@xxxxxxxxxxxxxx>
---
 docs/formatdomain.html.in     |   46 ++++++++++
 docs/schemas/domaincommon.rng |  184 ++++++++++++++++++++++++++++++++++++++++++
 src/conf/domain_conf.c        |   69 +++++++++++++++
 src/conf/domain_conf.h        |   42 +++++++++
 4 files changed, 341 insertions(+)

Index: libvirt/docs/schemas/domaincommon.rng
===================================================================
--- libvirt.orig/docs/schemas/domaincommon.rng
+++ libvirt/docs/schemas/domaincommon.rng
@@ -35,6 +35,9 @@
         <ref name="clock"/>
         <ref name="resources"/>
         <ref name="features"/>
+        <optional>
+          <ref name="domain_capabilities"/>
+        </optional>
         <ref name="termination"/>
         <optional>
           <ref name="devices"/>
@@ -2337,6 +2340,187 @@
     </optional>
   </define>
   <!--
+       A set of optional domain capabilities
+       -->
+  <define name="domain_capabilities">
+    <optional>
+      <element name="domain_capabilities">
+        <interleave>
+          <optional>
+            <element name="cap_chown">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_dac_override">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_dac_read_search">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_fowner">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_fsetid">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_kill">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_setgid">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_setuid">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_setpcap">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_linux_immutable">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_net_bind_service">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_net_broadcast">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_net_admin">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_net_raw">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_ipc_lock">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_ipc_owner">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_module">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_rawio">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_chroot">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_ptrace">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_pacct">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_admin">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_boot">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_nice">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_resource">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_time">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_sys_tty_config">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_mknod">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_lease">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_audit_write">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_audit_control">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_setfcap">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_mac_override">
+            <empty/>
+            </element>
+          </optional>
+          <optional>
+            <element name="cap_mac_admin">
+            <empty/>
+            </element>
+          </optional>
+        </interleave>
+      </element>
+    </optional>
+  </define>
+  <!--
       CPU specification
       -->
   <define name="cpu">
Index: libvirt/src/conf/domain_conf.c
===================================================================
--- libvirt.orig/src/conf/domain_conf.c
+++ libvirt/src/conf/domain_conf.c
@@ -104,6 +104,42 @@ VIR_ENUM_IMPL(virDomainFeature, VIR_DOMA
               "hap",
               "viridian")
 
+VIR_ENUM_IMPL(virDomainCapability, VIR_DOMAIN_CAPABILITY_LAST,
+              "cap_chown",
+              "cap_dac_override",
+              "cap_dac_read_search",
+              "cap_fowner",
+              "cap_fsetid",
+              "cap_kill",
+              "cap_setgid",
+              "cap_setuid",
+              "cap_setpcap",
+              "cap_linux_immutable",
+              "cap_net_bind_service",
+              "cap_net_broadcast",
+              "cap_net_admin",
+              "cap_net_raw",
+              "cap_ipc_lock",
+              "cap_ipc_owner",
+              "cap_sys_module",
+              "cap_sys_rawio",
+              "cap_sys_chroot",
+              "cap_sys_ptrace",
+              "cap_sys_pacct",
+              "cap_sys_admin",
+              "cap_sys_boot",
+              "cap_sys_nice",
+              "cap_sys_resource",
+              "cap_sys_time",
+              "cap_sys_tty_config",
+              "cap_mknod",
+              "cap_lease",
+              "cap_audit_write",
+              "cap_audit_control",
+              "cap_setfcap",
+              "cap_mac_override",
+              "cap_mac_admin")
+
 VIR_ENUM_IMPL(virDomainLifecycle, VIR_DOMAIN_LIFECYCLE_LAST,
               "destroy",
               "restart",
@@ -7213,6 +7249,23 @@ static virDomainDefPtr virDomainDefParse
         VIR_FREE(nodes);
     }
 
+    n = virXPathNodeSet("./domain_capabilities/*", ctxt, &nodes);
+    if (n < 0)
+        goto error;
+    if (n) {
+        for (i = 0; i < n; i++) {
+            int val = virDomainCapabilityTypeFromString((const char *)nodes[i]->name);
+            if (val < 0) {
+                virDomainReportError(VIR_ERR_INTERNAL_ERROR,
+                                     _("unexpected capability %s"),
+                                     nodes[i]->name);
+                goto error;
+            }
+            def->capabilities |= (1ULL << val);
+        }
+        VIR_FREE(nodes);
+    }
+
     if (virDomainLifecycleParseXML(ctxt, "string(./on_reboot[1])",
                                    &def->onReboot, VIR_DOMAIN_LIFECYCLE_RESTART,
                                    virDomainLifecycleTypeFromString) < 0)
@@ -11480,6 +11533,22 @@ virDomainDefFormatInternal(virDomainDefP
         virBufferAddLit(buf, "  </features>\n");
     }
 
+    if (def->capabilities) {
+        virBufferAddLit(buf, "  <domain_capabilities>\n");
+        for (n = 0; n < VIR_DOMAIN_CAPABILITY_LAST; n++) {
+            if (def->capabilities & (1ULL << n)) {
+                const char *name = virDomainCapabilityTypeToString(n);
+                if (!name) {
+                    virDomainReportError(VIR_ERR_INTERNAL_ERROR,
+                                         _("unexpected capability %d"), n);
+                    goto cleanup;
+                }
+                virBufferAsprintf(buf, "    <%s/>\n", name);
+            }
+        }
+        virBufferAddLit(buf, "  </domain_capabilities>\n");
+    }
+
     virBufferAdjustIndent(buf, 2);
     if (virCPUDefFormatBufFull(buf, def->cpu) < 0)
         goto cleanup;
Index: libvirt/src/conf/domain_conf.h
===================================================================
--- libvirt.orig/src/conf/domain_conf.h
+++ libvirt/src/conf/domain_conf.h
@@ -1175,6 +1175,45 @@ enum virDomainFeature {
     VIR_DOMAIN_FEATURE_LAST
 };
 
+enum virDomainCapability {
+    VIR_DOMAIN_CAPABILITY_CHOWN,
+    VIR_DOMAIN_CAPABILITY_DAC_OVERRIDE,
+    VIR_DOMAIN_CAPABILITY_DAC_READ_SEARCH,
+    VIR_DOMAIN_CAPABILITY_FOWNER,
+    VIR_DOMAIN_CAPABILITY_FSETID,
+    VIR_DOMAIN_CAPABILITY_KILL,
+    VIR_DOMAIN_CAPABILITY_SETGID,
+    VIR_DOMAIN_CAPABILITY_SETUID,
+    VIR_DOMAIN_CAPABILITY_SETPCAP,
+    VIR_DOMAIN_CAPABILITY_LINUX_IMMUTABLE,
+    VIR_DOMAIN_CAPABILITY_NET_BIND_SERVICE,
+    VIR_DOMAIN_CAPABILITY_NET_BROADCAST,
+    VIR_DOMAIN_CAPABILITY_NET_ADMIN,
+    VIR_DOMAIN_CAPABILITY_NET_RAW,
+    VIR_DOMAIN_CAPABILITY_IPC_LOCK,
+    VIR_DOMAIN_CAPABILITY_IPC_OWNER,
+    VIR_DOMAIN_CAPABILITY_SYS_MODULE,
+    VIR_DOMAIN_CAPABILITY_SYS_RAWIO,
+    VIR_DOMAIN_CAPABILITY_SYS_CHROOT,
+    VIR_DOMAIN_CAPABILITY_SYS_PTRACE,
+    VIR_DOMAIN_CAPABILITY_SYS_PACCT,
+    VIR_DOMAIN_CAPABILITY_SYS_ADMIN,
+    VIR_DOMAIN_CAPABILITY_SYS_BOOT,
+    VIR_DOMAIN_CAPABILITY_SYS_NICE,
+    VIR_DOMAIN_CAPABILITY_SYS_RESOURCE,
+    VIR_DOMAIN_CAPABILITY_SYS_TIME,
+    VIR_DOMAIN_CAPABILITY_SYS_TTY_CONFIG,
+    VIR_DOMAIN_CAPABILITY_MKNOD,
+    VIR_DOMAIN_CAPABILITY_LEASE,
+    VIR_DOMAIN_CAPABILITY_AUDIT_WRITE,
+    VIR_DOMAIN_CAPABILITY_AUDIT_CONTROL,
+    VIR_DOMAIN_CAPABILITY_SETFCAP,
+    VIR_DOMAIN_CAPABILITY_MAC_OVERRIDE,
+    VIR_DOMAIN_CAPABILITY_MAC_ADMIN,
+
+    VIR_DOMAIN_CAPABILITY_LAST
+};
+
 enum virDomainLifecycleAction {
     VIR_DOMAIN_LIFECYCLE_DESTROY,
     VIR_DOMAIN_LIFECYCLE_RESTART,
@@ -1440,6 +1479,8 @@ struct _virDomainDef {
     char *emulator;
     int features;
 
+    unsigned long long capabilities;
+
     virDomainClockDef clock;
 
     int ngraphics;
@@ -1951,6 +1992,7 @@ VIR_ENUM_DECL(virDomainTaint)
 VIR_ENUM_DECL(virDomainVirt)
 VIR_ENUM_DECL(virDomainBoot)
 VIR_ENUM_DECL(virDomainFeature)
+VIR_ENUM_DECL(virDomainCapability)
 VIR_ENUM_DECL(virDomainLifecycle)
 VIR_ENUM_DECL(virDomainLifecycleCrash)
 VIR_ENUM_DECL(virDomainDevice)
Index: libvirt/docs/formatdomain.html.in
===================================================================
--- libvirt.orig/docs/formatdomain.html.in
+++ libvirt/docs/formatdomain.html.in
@@ -787,6 +787,52 @@
       </dd>
     </dl>
 
+    <h3><a name="elementsDomainCapabilities">Domain capabilities</a></h3>
+
+    <p>
+      Domain is allowed to retain the specified capabilities.
+    </p>
+
+<pre>
+  ...
+  &lt;domain_capabilities&gt;
+    &lt;cap_chown/&gt;
+    &lt;cap_dac_override/&gt;
+    &lt;cap_dac_read_search/&gt;
+    &lt;cap_fowner/&gt;
+    &lt;cap_fsetid/&gt;
+    &lt;cap_kill/&gt;
+    &lt;cap_setgid/&gt;
+    &lt;cap_setuid/&gt;
+    &lt;cap_setpcap/&gt;
+    &lt;cap_linux_immutable/&gt;
+    &lt;cap_net_bind_service/&gt;
+    &lt;cap_net_broadcast/&gt;
+    &lt;cap_net_admin/&gt;
+    &lt;cap_net_raw/&gt;
+    &lt;cap_ipc_lock/&gt;
+    &lt;cap_ipc_owner/&gt;
+    &lt;cap_sys_module/&gt;
+    &lt;cap_sys_rawio/&gt;
+    &lt;cap_sys_chroot/&gt;
+    &lt;cap_sys_ptrace/&gt;
+    &lt;cap_sys_pacct/&gt;
+    &lt;cap_sys_admin/&gt;
+    &lt;cap_sys_boot/&gt;
+    &lt;cap_sys_nice/&gt;
+    &lt;cap_sys_resource/&gt;
+    &lt;cap_sys_time/&gt;
+    &lt;cap_sys_tty_config/&gt;
+    &lt;cap_mknod/&gt;
+    &lt;cap_lease/&gt;
+    &lt;cap_audit_write/&gt;
+    &lt;cap_audit_control/&gt;
+    &lt;cap_setfcap/&gt;
+    &lt;cap_mac_override/&gt;
+    &lt;cap_mac_admin/&gt;
+  &lt;/domain_capabilities&gt;
+  ...</pre>
+
     <h3><a name="elementsTime">Time keeping</a></h3>
 
     <p>

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list


[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]