提交 26d67015 编写于 作者: C Cédric Bosdonnat 提交者: Gao feng

lxc domain from xml: convert lxc.cap.drop

上级 47e5b5ae
...@@ -853,6 +853,28 @@ lxcSetBlkioTune(virDomainDefPtr def, virConfPtr properties) ...@@ -853,6 +853,28 @@ lxcSetBlkioTune(virDomainDefPtr def, virConfPtr properties)
return 0; return 0;
} }
static void
lxcSetCapDrop(virDomainDefPtr def, virConfPtr properties)
{
virConfValuePtr value;
char **toDrop = NULL;
const char *capString;
size_t i;
if ((value = virConfGetValue(properties, "lxc.cap.drop")) && value->str)
toDrop = virStringSplit(value->str, " ", 0);
for (i = 0; i < VIR_DOMAIN_CAPS_FEATURE_LAST; i++) {
capString = virDomainCapsFeatureTypeToString(i);
if (toDrop != NULL && virStringArrayHasString(toDrop, capString))
def->caps_features[i] = VIR_DOMAIN_FEATURE_STATE_OFF;
}
def->features[VIR_DOMAIN_FEATURE_CAPABILITIES] = VIR_DOMAIN_CAPABILITIES_POLICY_ALLOW;
virStringFreeList(toDrop);
}
virDomainDefPtr virDomainDefPtr
lxcParseConfigString(const char *config) lxcParseConfigString(const char *config)
{ {
...@@ -950,6 +972,9 @@ lxcParseConfigString(const char *config) ...@@ -950,6 +972,9 @@ lxcParseConfigString(const char *config)
if (lxcSetBlkioTune(vmdef, properties) < 0) if (lxcSetBlkioTune(vmdef, properties) < 0)
goto error; goto error;
/* lxc.cap.drop */
lxcSetCapDrop(vmdef, properties);
goto cleanup; goto cleanup;
error: error:
......
...@@ -25,6 +25,8 @@ ...@@ -25,6 +25,8 @@
</os> </os>
<features> <features>
<privnet/> <privnet/>
<capabilities policy='allow'>
</capabilities>
</features> </features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
......
...@@ -13,6 +13,8 @@ ...@@ -13,6 +13,8 @@
</os> </os>
<features> <features>
<privnet/> <privnet/>
<capabilities policy='allow'>
</capabilities>
</features> </features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
......
...@@ -15,6 +15,8 @@ ...@@ -15,6 +15,8 @@
</os> </os>
<features> <features>
<privnet/> <privnet/>
<capabilities policy='allow'>
</capabilities>
</features> </features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
......
...@@ -14,6 +14,8 @@ ...@@ -14,6 +14,8 @@
</idmap> </idmap>
<features> <features>
<privnet/> <privnet/>
<capabilities policy='allow'>
</capabilities>
</features> </features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
......
...@@ -8,6 +8,10 @@ ...@@ -8,6 +8,10 @@
<type>exe</type> <type>exe</type>
<init>/sbin/init</init> <init>/sbin/init</init>
</os> </os>
<features>
<capabilities policy='allow'>
</capabilities>
</features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot> <on_reboot>restart</on_reboot>
......
...@@ -15,6 +15,8 @@ ...@@ -15,6 +15,8 @@
</os> </os>
<features> <features>
<privnet/> <privnet/>
<capabilities policy='allow'>
</capabilities>
</features> </features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
......
...@@ -8,6 +8,10 @@ ...@@ -8,6 +8,10 @@
<type>exe</type> <type>exe</type>
<init>/sbin/init</init> <init>/sbin/init</init>
</os> </os>
<features>
<capabilities policy='allow'>
</capabilities>
</features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot> <on_reboot>restart</on_reboot>
......
...@@ -10,6 +10,8 @@ ...@@ -10,6 +10,8 @@
</os> </os>
<features> <features>
<privnet/> <privnet/>
<capabilities policy='allow'>
</capabilities>
</features> </features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
......
...@@ -8,6 +8,10 @@ ...@@ -8,6 +8,10 @@
<type>exe</type> <type>exe</type>
<init>/sbin/init</init> <init>/sbin/init</init>
</os> </os>
<features>
<capabilities policy='allow'>
</capabilities>
</features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot> <on_reboot>restart</on_reboot>
......
...@@ -8,6 +8,14 @@ ...@@ -8,6 +8,14 @@
<type arch='i686'>exe</type> <type arch='i686'>exe</type>
<init>/sbin/init</init> <init>/sbin/init</init>
</os> </os>
<features>
<capabilities policy='allow'>
<mac_admin state='off'/>
<mac_override state='off'/>
<mknod state='off'/>
<sys_module state='off'/>
</capabilities>
</features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot> <on_reboot>restart</on_reboot>
......
...@@ -8,6 +8,10 @@ ...@@ -8,6 +8,10 @@
<type>exe</type> <type>exe</type>
<init>/sbin/init</init> <init>/sbin/init</init>
</os> </os>
<features>
<capabilities policy='allow'>
</capabilities>
</features>
<clock offset='utc'/> <clock offset='utc'/>
<on_poweroff>destroy</on_poweroff> <on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot> <on_reboot>restart</on_reboot>
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册