Add two new security label types

Curently security labels can be of type 'dynamic' or 'static'.
If no security label is given, then 'dynamic' is assumed. The
current code takes advantage of this default, and avoids even
saving <seclabel> elements with type='dynamic' to disk. This
means if you temporarily change security driver, the guests
can all still start.

With the introduction of sVirt to LXC though, there needs to be
a new default of 'none' to allow unconfined LXC containers.

This patch introduces two new security label types

 - default:  the host configuration decides whether to run the
             guest with type 'none' or 'dynamic' at guest start
 - none:     the guest will run unconfined by security policy

The 'none' label type will obviously be undesirable for some
deployments, so a new qemu.conf option allows a host admin to
mandate confined guests. It is also possible to turn off default
confinement

  security_default_confined = 1|0  (default == 1)
  security_require_confined = 1|0  (default == 0)

* src/conf/domain_conf.c, src/conf/domain_conf.h: Add new
  seclabel types
* src/security/security_manager.c, src/security/security_manager.h:
  Set default sec label types
* src/security/security_selinux.c: Handle 'none' seclabel type
* src/qemu/qemu.conf, src/qemu/qemu_conf.c, src/qemu/qemu_conf.h,
  src/qemu/libvirtd_qemu.aug: New security config options
* src/qemu/qemu_driver.c: Tell security driver about default
  config

docs/formatdomain.html.in

@@ -3539,16 +3539,18 @@ qemu-kvm -net nic,model=? /dev/null
 
     <p>
       The <code>seclabel</code> element allows control over the
-      operation of the security drivers. There are two basic
-      modes of operation, dynamic where libvirt automatically
-      generates a unique security label, or static where the
-      application/administrator chooses the labels. With dynamic
+      operation of the security drivers. There are three basic
+      modes of operation, 'dynamic' where libvirt automatically
+      generates a unique security label, 'static' where the
+      application/administrator chooses the labels, or 'none'
+      where confinement is disabled. With dynamic
       label generation, libvirt will always automatically
       relabel any resources associated with the virtual machine.
       With static label assignment, by default, the administrator
       or application must ensure labels are set correctly on any
       resources, however, automatic relabeling can be enabled
-      if desired.
+      if desired.  <span class="since">'dynamic' since 0.6.1, 'static'
+      since 0.6.2, and 'none' since 0.9.10.</span>
     </p>
 
     <p>
@@ -3570,8 +3572,17 @@ qemu-kvm -net nic,model=? /dev/null
   &lt;seclabel type='static' model='selinux' relabel='yes'&gt;
     &lt;label&gt;system_u:system_r:svirt_t:s0:c392,c662&lt;/label&gt;
   &lt;/seclabel&gt;
+
+  &lt;seclabel type='none'/&gt;
     </pre>
 
+    <p>
+      If no 'type' attribute is provided in the input XML, then
+      the security driver default setting will be used, which
+      may be either 'none' or 'dynamic'. If a 'baselabel' is set
+      but no 'type' is set, then the type is presumed to be 'dynamic'
+    </p>
+
     <p>
       When viewing the XML for a running guest with automatic
       resource relabeling active, an additional XML element,
@@ -3581,9 +3592,9 @@ qemu-kvm -net nic,model=? /dev/null
     </p>
     <dl>
       <dt><code>type</code></dt>
-      <dd>Either <code>static</code> or <code>dynamic</code> to determine
-        whether libvirt automatically generates a unique security label
-        or not.
+      <dd>Either <code>static</code>, <code>dynamic</code> or <code>none</code>
+        to determine whether libvirt automatically generates a unique security
+        label or not.
       </dd>
       <dt><code>model</code></dt>
       <dd>A valid security model name, matching the currently

docs/schemas/domaincommon.rng

@@ -129,6 +129,11 @@
             </optional>
           </interleave>
         </group>
+        <group>
+          <attribute name='type'>
+            <value>none</value>
+          </attribute>
+        </group>
       </choice>
     </element>
   </define>