[libvirt] [PATCH 0/7] security: Allow disabling security per VM

[Cole Robinson]

Enabling a security driver in qemu.conf is currently all or nothing.
The option to disable security on a per VM basis can be a useful debugging
tool or work around for frustrated users.

Patches 1-3 and 5-6 are prep and cleanup work. Patch 4 fixes an
easily triggerable segfault when defining a domain in qemu. Patch 7
is the actual feature.

Cole Robinson (7):
  tests: Add qemuxml2xml tests for <seclabel> handling
  security: Use virDomainSeclabelDefClear
  security: Add virSecurityIsSpecifiedDriver
  qemu: Fix segfault if defining a domain without <seclabel>
  domain: Handle seclabel model with an enum
  domain: Always validate seclabel model
  security: Allow disabling security on a per VM basis

 cfg.mk                                             |    1 +
 docs/schemas/domain.rng                            |   13 ++-
 src/conf/domain_conf.c                             |   69 ++++++++++-----
 src/conf/domain_conf.h                             |   15 +++-
 src/libvirt_private.syms                           |    2 +-
 src/qemu/qemu_driver.c                             |    4 +-
 src/security/security_apparmor.c                   |   31 ++-----
 src/security/security_driver.c                     |   25 ++++++
 src/security/security_driver.h                     |    3 +
 src/security/security_manager.c                    |   90 +++++++++++++-------
 src/security/security_selinux.c                    |   50 +++---------
 tests/domainschematest                             |    2 +-
 .../qemuxml2xml-balloon-device-auto-out.xml        |   25 ++++++
 .../qemuxml2xml-channel-virtio-auto-out.xml        |   54 ++++++++++++
 .../qemuxml2xml-console-compat-auto-out.xml        |   31 +++++++
 .../qemuxml2xml-console-virtio-out.xml             |   29 ++++++
 .../qemuxml2xml-disk-scsi-device-auto-out.xml      |   31 +++++++
 .../qemuxml2xml-seclabel-dynamic-in.xml            |   24 +++++
 .../qemuxml2xml-seclabel-dynamic-out.xml           |   21 +++++
 .../qemuxml2xml-seclabel-model-none-in.xml         |   21 +++++
 .../qemuxml2xml-seclabel-model-none-out.xml        |   21 +++++
 .../qemuxml2xml-seclabel-static-in.xml             |   24 +++++
 .../qemuxml2xml-seclabel-static-out.xml            |   23 +++++
 .../qemuxml2xmlout-balloon-device-auto.xml         |   25 ------
 .../qemuxml2xmlout-channel-virtio-auto.xml         |   54 ------------
 .../qemuxml2xmlout-console-compat-auto.xml         |   31 -------
 .../qemuxml2xmlout-console-virtio.xml              |   29 ------
 .../qemuxml2xmlout-disk-scsi-device-auto.xml       |   31 -------
 tests/qemuxml2xmltest.c                            |   26 ++++--
 29 files changed, 501 insertions(+), 304 deletions(-)
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-balloon-device-auto-out.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-channel-virtio-auto-out.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-console-compat-auto-out.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-console-virtio-out.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-disk-scsi-device-auto-out.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-dynamic-in.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-dynamic-out.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-model-none-in.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-model-none-out.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-static-in.xml
 create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-static-out.xml
 delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-balloon-device-auto.xml
 delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-channel-virtio-auto.xml
 delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-console-compat-auto.xml
 delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-console-virtio.xml
 delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-scsi-device-auto.xml

-- 
1.7.3.2