# Master configuration file for the QEMU driver.

# All settings described here are optional - if omitted, sensible

# defaults are used.

 

# VNC is configured to listen on 127.0.0.1 by default.

# To make it listen on all public interfaces, uncomment

# this next option.

#

# NB, strong recommendation to enable TLS + x509 certificate

# verification when allowing public access

#

# vnc_listen = "0.0.0.0"

 

 

# Enable use of TLS encryption on the VNC server. This requires

# a VNC client which supports the VeNCrypt protocol extension.

# Examples include vinagre, virt-viewer, virt-manager and vencrypt

# itself. UltraVNC, RealVNC, TightVNC do not support this

#

# It is necessary to setup CA and issue a server certificate

# before enabling this.

#

# vnc_tls = 1

 

 

# Use of TLS requires that x509 certificates be issued. The

# default it to keep them in /etc/pki/libvirt-vnc. This directory

# must contain

#

#  ca-cert.pem - the CA master certificate

#  server-cert.pem - the server certificate signed with ca-cert.pem

#  server-key.pem  - the server private key

#

# This option allows the certificate directory to be changed

#

# vnc_tls_x509_cert_dir = "/etc/pki/libvirt-vnc"

 

 

# The default TLS configuration only uses certificates for the server

# allowing the client to verify the server's identity and establish

# and encrypted channel.

#

# It is possible to use x509 certificates for authentication too, by

# issuing a x509 certificate to every client who needs to connect.

#

# Enabling this option will reject any client who does not have a

# certificate signed by the CA in /etc/pki/libvirt-vnc/ca-cert.pem

#

# vnc_tls_x509_verify = 1

 

 

# The default VNC password. Only 8 letters are significant for

# VNC passwords. This parameter is only used if the per-domain

# XML config does not already provide a password. To allow

# access without passwords, leave this commented out. An empty

# string will still enable passwords, but be rejected by QEMU

# effectively preventing any use of VNC. Obviously change this

# example here before you set this

#

# vnc_password = "XYZ12345"

 

 

# Enable use of SASL encryption on the VNC server. This requires

# a VNC client which supports the SASL protocol extension.

# Examples include vinagre, virt-viewer and virt-manager

# itself. UltraVNC, RealVNC, TightVNC do not support this

#

# It is necessary to configure /etc/sasl2/qemu.conf to choose

# the desired SASL plugin (eg, GSSPI for Kerberos)

#

# vnc_sasl = 1

 

 

# The default SASL configuration file is located in /etc/sasl2/

# When running libvirtd unprivileged, it may be desirable to

# override the configs in this location. Set this parameter to

# point to the directory, and create a qemu.conf in that location

#

# vnc_sasl_dir = "/some/directory/sasl2"

 

 

 

 

# The default security driver is SELinux. If SELinux is disabled

# on the host, then the security driver will automatically disable

# itself. If you wish to disable QEMU SELinux security driver while

# leaving SELinux enabled for the host in general, then set this

# to 'none' instead

#

# security_driver = "selinux"

security_driver = "none"

 

 

# The user ID for QEMU processes run by the system instance

#user = "libvirt-qemu"

user = "root"

 

# The group ID for QEMU processes run by the system instance

#group = "kvm"

group = "root"

 

 

# What cgroup controllers to make use of with QEMU guests

#

#  - 'cpu' - use for schedular tunables

#  - 'devices' - use for device whitelisting

#

# NB, even if configured here, they won't be used unless

# the adminsitrator has mounted cgroups. eg

#

#  mkdir /dev/cgroup

#  mount -t cgroup -o devices,cpu none /dev/cgroup

#

# They can be mounted anywhere, and different controlers

# can be mounted in different locations. libvirt will detect

# where they are located.

#

# cgroup_controllers = [ "cpu", "devices" ]

 

# This is the basic set of devices allowed / required by

# all virtual machines.

#

# As well as this, any configured block backed disks,

# all sound device, and all PTY devices are allowed.

#

# This will only need setting if newer QEMU suddenly

# wants some device we don't already know a bout.

#

#cgroup_device_acl = [

#    "/dev/null", "/dev/full", "/dev/zero",

#    "/dev/random", "/dev/urandom",

#    "/dev/ptmx", "/dev/kvm", "/dev/kqemu",

#    "/dev/rtc", "/dev/hpet", "/dev/net/tun",

#]

 

# The default format for Qemu/KVM guest save images is raw; that is, the

# memory from the domain is dumped out directly to a file.  If you have

# guests with a large amount of memory, however, this can take up quite

# a bit of space.  If you would like to compress the images while they

# are being saved to disk, you can also set "lzop", "gzip", "bzip2", or "xz"

# for save_image_format.  Note that this means you slow down the process of

# saving a domain in order to save disk space; the list above is in descending

# order by performance and ascending order by compression ratio.

#

# save_image_format = "raw"

 

# If provided by the host and a hugetlbfs mount point is configured,

# a guest may request huge page backing.  When this mount point is

# unspecified here, determination of a host mount point in /proc/mounts

# will be attempted.  Specifying an explicit mount overrides detection

# of the same in /proc/mounts.  Setting the mount point to "" will

# disable guest hugepage backing.

#

# NB, within this mount point, guests will create memory backing files

# in a location of  $MOUNTPOINT/libvirt/qemu

 

# hugetlbfs_mount = "/dev/hugepages"

 

# mac_filter enables MAC addressed based filtering on bridge ports.

# This currently requires ebtables to be installed.

#

# mac_filter = 1