lxc domain from xml: convert lxc.cap.drop

diff --git a/src/lxc/lxc_native.c b/src/lxc/lxc_native.c
index 2fbc262450a563f19ae52421d3dfc20d86d4043c..7735a3b4a8b1d71effc502248c855a8de1ba80b1 100644 (file)
--- a/src/lxc/lxc_native.c
+++ b/src/lxc/lxc_native.c
@@ -853,6 +853,28 @@ lxcSetBlkioTune(virDomainDefPtr def, virConfPtr properties)
     return 0;
 }
 
+static void
+lxcSetCapDrop(virDomainDefPtr def, virConfPtr properties)
+{
+    virConfValuePtr value;
+    char **toDrop = NULL;
+    const char *capString;
+    size_t i;
+
+    if ((value = virConfGetValue(properties, "lxc.cap.drop")) && value->str)
+        toDrop = virStringSplit(value->str, " ", 0);
+
+    for (i = 0; i < VIR_DOMAIN_CAPS_FEATURE_LAST; i++) {
+        capString = virDomainCapsFeatureTypeToString(i);
+        if (toDrop != NULL && virStringArrayHasString(toDrop, capString))
+            def->caps_features[i] = VIR_DOMAIN_FEATURE_STATE_OFF;
+    }
+
+    def->features[VIR_DOMAIN_FEATURE_CAPABILITIES] = VIR_DOMAIN_CAPABILITIES_POLICY_ALLOW;
+
+    virStringFreeList(toDrop);
+}
+
 virDomainDefPtr
 lxcParseConfigString(const char *config)
 {
@@ -950,6 +972,9 @@ lxcParseConfigString(const char *config)
     if (lxcSetBlkioTune(vmdef, properties) < 0)
         goto error;
 
+    /* lxc.cap.drop */
+    lxcSetCapDrop(vmdef, properties);
+
     goto cleanup;
 
  error:

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml b/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml
index 36b8e52f28dac2e66cdfaa027a76d89dd732152d..c9c046969ace4f3aa41253eacc2da5fa4b224115 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-blkiotune.xml
@@ -25,6 +25,8 @@
   </os>
   <features>
     <privnet/>
+    <capabilities policy='allow'>
+    </capabilities>
   </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml b/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml
index 932ab6168e94270e86ad6d283a1137ce6ec7c1da..e7863fa13f84e7356af174bffe480efedd7e2c04 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml
@@ -13,6 +13,8 @@
   </os>
   <features>
     <privnet/>
+    <capabilities policy='allow'>
+    </capabilities>
   </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml b/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml
index 1bab1c65ac25392b52a15135eb7f8012c9061965..50c5358abef63accd9ffff30fac8ac6992f58a71 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-cputune.xml
@@ -15,6 +15,8 @@
   </os>
   <features>
     <privnet/>
+    <capabilities policy='allow'>
+    </capabilities>
   </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml b/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml
index 050ccd6f72033deaf0c2be37669801570fe435db..80a83ff78ab0624ac97b962a883d42c7f260137e 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-idmap.xml
@@ -14,6 +14,8 @@
   </idmap>
   <features>
     <privnet/>
+    <capabilities policy='allow'>
+    </capabilities>
   </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml
index 996c0f7496bcb4cce637379a7d2d61edc2efbedc..3105b8cefc9322f335207b296703686a0401e47c 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-macvlannetwork.xml
@@ -8,6 +8,10 @@
     <type>exe</type>
     <init>/sbin/init</init>
   </os>
+  <features>
+    <capabilities policy='allow'>
+    </capabilities>
+  </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml b/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml
index b7c919e7a02ef2cd99f1b75bd43b313199188e4b..7df1ef0e98b0e9278750806e41a31b627d18093a 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-memtune.xml
@@ -15,6 +15,8 @@
   </os>
   <features>
     <privnet/>
+    <capabilities policy='allow'>
+    </capabilities>
   </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml
index 6d9e16de45beb00ebb7ceca04c003a7ff3492e2d..e002b99a6625317e7b27fa2f892029fe5f60561c 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-nonenetwork.xml
@@ -8,6 +8,10 @@
     <type>exe</type>
     <init>/sbin/init</init>
   </os>
+  <features>
+    <capabilities policy='allow'>
+    </capabilities>
+  </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml
index 101324ad1c2968fbc65d77889c057ac5a86aa635..dc9d6350f5c67e98682f4345e5c857ce9d730891 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-nonetwork.xml
@@ -10,6 +10,8 @@
   </os>
   <features>
     <privnet/>
+    <capabilities policy='allow'>
+    </capabilities>
   </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml
index 5fe1b03b37b19a6bb19ce5a6e3566eab21147ec4..cfaceb520d14fae5ebe48d74c9c330556999ab9a 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml
@@ -8,6 +8,10 @@
     <type>exe</type>
     <init>/sbin/init</init>
   </os>
+  <features>
+    <capabilities policy='allow'>
+    </capabilities>
+  </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-simple.xml b/tests/lxcconf2xmldata/lxcconf2xml-simple.xml
index dabb76ee5e3b860ef4ba09344764e608bde723dd..10428ec615405cbefca60b29b455084044c50393 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-simple.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-simple.xml
@@ -8,6 +8,14 @@
     <type arch='i686'>exe</type>
     <init>/sbin/init</init>
   </os>
+  <features>
+    <capabilities policy='allow'>
+      <mac_admin state='off'/>
+      <mac_override state='off'/>
+      <mknod state='off'/>
+      <sys_module state='off'/>
+    </capabilities>
+  </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>

diff --git a/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml b/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml
index 45348ed159686600f1a009196e681ce10ddba1ba..712be3e1ec45f59da6712942cc266f4b476b21bb 100644 (file)
--- a/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml
+++ b/tests/lxcconf2xmldata/lxcconf2xml-vlannetwork.xml
@@ -8,6 +8,10 @@
     <type>exe</type>
     <init>/sbin/init</init>
   </os>
+  <features>
+    <capabilities policy='allow'>
+    </capabilities>
+  </features>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>