On 01/25/2012 07:12 AM, Daniel P. Berrange wrote: > From: "Daniel P. Berrange" <berrange@xxxxxxxxxx> > > For the sake of backwards compat, LXC guests are *not* > confined by default. This is because it is not practical > to dynamically relabel containers using large filesystem > trees. Applications can create confined containers though, > by giving suitable XML configs > > * src/Makefile.am: Link libvirt_lxc to security drivers > * src/lxc/libvirtd_lxc.aug, src/lxc/lxc_conf.h, > src/lxc/lxc_conf.c, src/lxc/lxc.conf, > src/lxc/test_libvirtd_lxc.aug: Config file handling for > security driver > * src/lxc/lxc_driver.c: Wire up security driver functions > * src/lxc/lxc_controller.c: Add a '--security' flag to > specify which security driver to activate > * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Set > the process label just before exec'ing init. > --- > src/Makefile.am | 13 +++ > src/lxc/libvirtd_lxc.aug | 15 +++- > src/lxc/lxc.conf | 18 ++++ > src/lxc/lxc_conf.c | 62 ++++++++++++-- > src/lxc/lxc_conf.h | 8 ++- > src/lxc/lxc_container.c | 9 ++- > src/lxc/lxc_container.h | 2 + > src/lxc/lxc_controller.c | 28 +++++- > src/lxc/lxc_driver.c | 193 ++++++++++++++++++++++++++++++++++++++++- > src/lxc/test_libvirtd_lxc.aug | 2 + > 10 files changed, 335 insertions(+), 15 deletions(-) > ACK. -- Eric Blake eblake@xxxxxxxxxx +1-919-301-3266 Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list