[libvirt] [PATCH v3 13/15] vircgroup: introduce virCgroupV2DenyAllDevices
If we want to deny all devices we just need to replace any existing
program with new program with empty map.
Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com>
---
src/util/vircgroupv2.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c
index a8ba9b9e9e..6c851f9637 100644
--- a/src/util/vircgroupv2.c
+++ b/src/util/vircgroupv2.c
@@ -1725,6 +1725,16 @@ virCgroupV2AllowAllDevices(virCgroupPtr group,
}
+static int
+virCgroupV2DenyAllDevices(virCgroupPtr group)
+{
+ if (virCgroupV2DevicesDetectProg(group) < 0)
+ return -1;
+
+ return virCgroupV2DevicesCreateProg(group);
+}
+
+
virCgroupBackend virCgroupV2Backend = {
.type = VIR_CGROUP_BACKEND_TYPE_V2,
@@ -1777,6 +1787,7 @@ virCgroupBackend virCgroupV2Backend = {
.allowDevice = virCgroupV2AllowDevice,
.denyDevice = virCgroupV2DenyDevice,
.allowAllDevices = virCgroupV2AllowAllDevices,
+ .denyAllDevices = virCgroupV2DenyAllDevices,
.setCpuShares = virCgroupV2SetCpuShares,
.getCpuShares = virCgroupV2GetCpuShares,
--
2.20.1