• E
    cgroup: allow fine-tuning of device ACL permissions · 5564c575
    Eric Blake 提交于
    Adding audit points showed that we were granting too much privilege
    to qemu; it should not need any mknod rights to recreate any
    devices.  On the other hand, lxc should have all device privileges.
    The solution is adding a flag parameter.
    
    This also lets us restrict write access to read-only disks.
    
    * src/util/cgroup.h (virCgroup*Device*): Adjust prototypes.
    * src/util/cgroup.c (virCgroupAllowDevice)
    (virCgroupAllowDeviceMajor, virCgroupAllowDevicePath)
    (virCgroupDenyDevice, virCgroupDenyDeviceMajor)
    (virCgroupDenyDevicePath): Add parameter.
    * src/qemu/qemu_driver.c (qemudDomainSaveFlag): Update clients.
    * src/lxc/lxc_controller.c (lxcSetContainerResources): Likewise.
    * src/qemu/qemu_cgroup.c: Likewise.
    (qemuSetupDiskPathAllow): Also, honor read-only disks.
    5564c575
qemu_driver.c 208.5 KB