Skip to content

Commit dbb77c4

Browse files
tbazantdariavladykina
tbazant
and
dariavladykina
authored
Last changes to reviewed smartdocs (#274)
* Apply suggestions from code review Co-authored-by: Daria Vladykina <daria.vladykina@suse.com>
1 parent 0ecf19c commit dbb77c4

18 files changed

Lines changed: 322 additions & 131 deletions

‎articles/subnet-manager-configuring.asm.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
<resources>
1717
<resource xml:id="_concept-opensm" href="../concepts/opensm.xml"/>
1818
<resource xml:id="_task-opensm-configuring" href="../tasks/opensm-configuring.xml"/>
19+
<resource xml:id="_glue-opensm-more-info" href="../glues/opensm-more-info.xml"/>
1920
<resource href="../common/legal.xml" xml:id="_legal"/>
2021
<resource href="../common/license_gfdl1.2.xml" xml:id="_gfdl"/>
2122
</resources>
@@ -109,6 +110,7 @@
109110
</abstract>
110111
</merge>
111112
</module>
113+
<module resourceref="_glue-opensm-more-info"/>
112114
<!-- pull in a topic and switch the title -->
113115
<module resourceref="_legal"/>
114116
<module resourceref="_gfdl">

‎articles/systemd-securing.asm.xml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
<resource href="../concepts/systemd-securing.xml" xml:id="_systemd-securing"/>
2222
<resource href="../tasks/systemd-analyze-security-service-files.xml" xml:id="_systemd-analyze-security-service-files"/>
2323
<resource href="../references/systemd-securing-techniques.xml" xml:id="_systemd-securing-techniques"/>
24+
<resource href="../glues/systemd-securing-more-info.xml" xml:id="_systemd-securing-more-info"/>
2425
<resource href="../common/legal.xml" xml:id="_legal"/>
2526
<resource href="../common/license_gfdl1.2.xml" xml:id="_gfdl"/>
2627
</resources>
@@ -88,17 +89,19 @@
8889
<term>WHAT?</term>
8990
<listitem>
9091
<para>
91-
A &systemd; service file can limit the privileges of the service it is running
92-
in several ways.
92+
&systemd; service files are most often used to operate one or more &systemd;
93+
services, such as starting, stopping or viewing the status of the service. Besides
94+
this, the service files can limit the privileges of the service they control.
9395
</para>
9496
</listitem>
9597
</varlistentry>
9698
<varlistentry>
9799
<term>WHY?</term>
98100
<listitem>
99101
<para>
100-
Using security options of &systemd; service files can increase the overall security
101-
level of the whole operating system.
102+
Using security options of &systemd; service files increases the security of the
103+
service they control. This adds another security layer of the whole operating
104+
system.
102105
</para>
103106
</listitem>
104107
</varlistentry>
@@ -142,6 +145,7 @@
142145
<title>Techniques of securing</title>
143146
</merge>
144147
</module>
148+
<module resourceref="_systemd-securing-more-info"/>
145149
<module resourceref="_legal"/>
146150
<module resourceref="_gfdl">
147151
<output renderas="appendix"/>

‎articles/virtualization.asm.xml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,9 @@
1515
<resources>
1616
<resource href="../concepts/virtualization.xml" xml:id="_concept-virtualization"/>
1717
<resource href="../references/virtualization-modes.xml" xml:id="_reference-virtualization-modes"/>
18-
<resource href="../references/virtualization-scenarios.xml" xml:id="_reference-virtualization-scenarios"/>
18+
<resource href="../references/virtualization-scenarios.xml"
19+
xml:id="_reference-virtualization-scenarios"/>
20+
<resource href="../glues/virtualization-more-info.xml" xml:id="_glue-virtualization-more-info"/>
1921
<resource href="../common/legal.xml" xml:id="_legal">
2022
<description>Legal Notice</description>
2123
</resource>
@@ -114,6 +116,7 @@
114116
<module resourceref="_concept-virtualization" renderas="section"/>
115117
<module resourceref="_reference-virtualization-modes" renderas="section"/>
116118
<module resourceref="_reference-virtualization-scenarios" renderas="section"/>
119+
<module resourceref="_glue-virtualization-more-info"/>
117120
<module resourceref="_legal"/>
118121
<module resourceref="_gfdl">
119122
<output renderas="appendix"/>

‎articles/vm-assign-pci-device.asm.xml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
<resource href="../tasks/vm-assign-pci-device-virsh.xml" xml:id="_task-vm-assign-pci-device-virsh"/>
2323
<resource href="../tasks/vm-assign-pci-device-unmanaged.xml" xml:id="_task-vm-assign-pci-device-unmanaged"/>
2424
<resource href="../tasks/vm-assign-pci-device-vmm.xml" xml:id="_task-vm-assign-pci-device-vmm"/>
25+
<resource href="../tasks/vm-assign-pci-device-troubleshooting.xml" xml:id="_task-vm-assign-pci-device-troubleshooting"/>
2526
<resource href="../common/legal.xml" xml:id="_legal">
2627
<description>Legal Notice</description>
2728
</resource>
@@ -93,7 +94,8 @@
9394
<term>WHAT?</term>
9495
<listitem>
9596
<para>
96-
Virtual machines can directly access host PCI or USB devices.
97+
Virtual machines can directly access host PCI or USB devices, such as graphics
98+
cards or network adapters.
9799
</para>
98100
</listitem>
99101
</varlistentry>
@@ -102,7 +104,8 @@
102104
<listitem>
103105
<para>
104106
A virtual machine that is assigned direct access to a host device can use all its
105-
capabilities.
107+
capabilities, bypassing the virtualization layer. Such an approach offers near-native
108+
performance or hardware acceleration.
106109
</para>
107110
</listitem>
108111
</varlistentry>
@@ -152,24 +155,24 @@
152155
</abstract>
153156
</merge>
154157
<module resourceref="_glue-vm-assign-pci-device-intro"/>
155-
<module resourceref="_task-vm-assign-pci-device-virsh">
158+
<module resourceref="_task-vm-assign-pci-device-vmm">
156159
<merge>
157-
<title>Assigning a device using &virsh;</title>
160+
<title>Assigning a device using &vmm;</title>
158161
<abstract>
159162
<para>
160163
The following procedure describes how to assign a host device to a &vmguest; using the
161-
&virsh; command-line tool.
164+
&vmm; GUI application.
162165
</para>
163166
</abstract>
164167
</merge>
165168
</module>
166-
<module resourceref="_task-vm-assign-pci-device-vmm">
169+
<module resourceref="_task-vm-assign-pci-device-virsh">
167170
<merge>
168-
<title>Assigning a device using &vmm;</title>
171+
<title>Assigning a device using &virsh;</title>
169172
<abstract>
170173
<para>
171174
The following procedure describes how to assign a host device to a &vmguest; using the
172-
&vmm; GUI application.
175+
&virsh; command-line tool.
173176
</para>
174177
</abstract>
175178
</merge>
@@ -182,6 +185,7 @@
182185
</abstract>
183186
</merge>
184187
</module>
188+
<module resourceref="_task-vm-assign-pci-device-troubleshooting"/>
185189
<module resourceref="_legal"/>
186190
<module resourceref="_gfdl" renderas="appendix"/>
187191
</structure>

‎concepts/systemd-securing.xml‎

Lines changed: 8 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,14 @@
1919
<para>
2020
Linux increases its security by separating privileges between individual components of the
2121
operating system. System services already have a default level of security. For example,
22-
their processes run under their own user ID, which limits the changes they can perform on the
23-
system.
22+
their processes run under their own user ID, which limits the changes they can perform on
23+
the system.
2424
</para>
2525

2626
<para>
2727
The default level of privilege separation provides only a basic protection. Services can
28-
still perform as many changes as normal local users, though not as many as &rootuser;.
29-
A higher level of system security requires limiting what services can perform and prevents
28+
still perform as many changes as normal local users, though not as many as &rootuser;. A
29+
higher level of system security requires limiting what services can perform and prevents
3030
them from certain privileges that normal users are allowed to use.
3131
</para>
3232
</abstract>
@@ -36,10 +36,10 @@
3636
<title>How does securing services with &systemd; work?</title>
3737
<para>
3838
There are several methods to secure processes and applications that you can use
39-
simultaneously. For example, confining with &selnx; or &aa; is recommended. &systemd; can
40-
apply additional restrictions to local services by using technologies included in the kernel.
41-
These restrictions are activated by adding specific options to the &systemd; service
42-
definition and restarting the service.
39+
simultaneously. For example, confining with &selnx; <phrase os="sles">or &aa; </phrase>is
40+
recommended. &systemd; can apply additional restrictions to local services by using
41+
technologies included in the kernel. These restrictions are activated by adding specific
42+
options to the &systemd; service definition and restarting the service.
4343
</para>
4444
</section>
4545
<section xml:id="benefits-securing-with-systemd">
@@ -49,45 +49,4 @@
4949
sensitive data contained on its file system.
5050
</para>
5151
</section>
52-
<section xml:id="related-securing-with-systemd">
53-
<title>Related topics</title>
54-
<itemizedlist>
55-
<listitem>
56-
<para>
57-
All security options are described in &systemd;'s man pages. Refer to <command>man 5
58-
systemd.exec</command>.
59-
</para>
60-
</listitem>
61-
<listitem>
62-
<para>
63-
The list of currently defined kernel capabilities is available in <command>man 7
64-
capabilities</command>.
65-
</para>
66-
</listitem>
67-
<listitem>
68-
<para>
69-
Enabling and disabling &systemd; services is described in
70-
<link xlink:href="https://documentation.suse.com/smart/linux/html/reference-systemctl-enable-disable-services/reference-systemctl-enable-disable-services.html"/>.
71-
</para>
72-
</listitem>
73-
<listitem>
74-
<para>
75-
Managing &systemd; targets with <command>systemctl</command> is described in
76-
<link xlink:href="https://documentation.suse.com/smart/linux/html/reference-managing-systemd-targets-systemctl/reference-systemctl-managing-targets.html"/>.
77-
</para>
78-
</listitem>
79-
<listitem>
80-
<para>
81-
Sending termination signals to &systemd; services is described in
82-
<link xlink:href="https://documentation.suse.com/smart/linux/html/task-send-termination-signals-systemd/task-send-termination-signals-systemd.html"/>.
83-
</para>
84-
</listitem>
85-
<listitem>
86-
<para>
87-
Starting and stopping &systemd; services is described in
88-
<link xlink:href="https://documentation.suse.com/smart/linux/html/reference-systemctl-start-stop-services/reference-systemctl-start-stop-services.html"/>.
89-
</para>
90-
</listitem>
91-
</itemizedlist>
92-
</section>
9352
</topic>

‎glues/opensm-more-info.xml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE topic
3+
[
4+
<!ENTITY % entities SYSTEM "../xml/generic-entities.ent">
5+
%entities;
6+
]>
7+
<topic xml:id="glue-alp-containers-podman-more-info"
8+
role="glue" xml:lang="en"
9+
xmlns="http://docbook.org/ns/docbook" version="5.2"
10+
xmlns:its="http://www.w3.org/2005/11/its"
11+
xmlns:xi="http://www.w3.org/2001/XInclude"
12+
xmlns:xlink="http://www.w3.org/1999/xlink"
13+
xmlns:trans="http://docbook.org/ns/transclusion">
14+
<title>For more information</title>
15+
<info>
16+
<meta name="maintainer" content="tbazant@suse.com"/>
17+
</info>
18+
<para>
19+
Find detailed information in the following sources:
20+
</para>
21+
<itemizedlist>
22+
<listitem>
23+
<para>
24+
<link xlink:href="https://www.infinibandta.org/about-infiniband/">&infiniband;</link> home
25+
page
26+
</para>
27+
</listitem>
28+
<listitem>
29+
<para>
30+
&nvidia; documentation on
31+
<link xlink:href="https://docs.nvidia.com/networking/display/mlnxosv3111014/subnet+manager">&subnetmanager;</link>
32+
</para>
33+
</listitem>
34+
<listitem>
35+
<para>
36+
&nvidia; documentation on
37+
<link xlink:href="https://docs.nvidia.com/networking/display/mlnxofedv541030/opensm">&opensm;</link>
38+
</para>
39+
</listitem>
40+
</itemizedlist>
41+
</topic>

‎glues/systemd-securing-more-info.xml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE topic
3+
[
4+
<!ENTITY % entities SYSTEM "../xml/generic-entities.ent">
5+
%entities;
6+
]>
7+
<topic xml:id="systemd-securing-more-info"
8+
role="glue" xml:lang="en"
9+
xmlns="http://docbook.org/ns/docbook" version="5.2"
10+
xmlns:its="http://www.w3.org/2005/11/its"
11+
xmlns:xi="http://www.w3.org/2001/XInclude"
12+
xmlns:xlink="http://www.w3.org/1999/xlink"
13+
xmlns:trans="http://docbook.org/ns/transclusion">
14+
<title>For more information</title>
15+
<info>
16+
<meta name="maintainer" content="tbazant@suse.com"/>
17+
</info>
18+
<itemizedlist>
19+
<listitem>
20+
<para>
21+
All security options are described in &systemd;'s man pages. Refer to <command>man 5
22+
systemd.exec</command>.
23+
</para>
24+
</listitem>
25+
<listitem>
26+
<para>
27+
The list of currently defined kernel capabilities is available in <command>man 7
28+
capabilities</command>.
29+
</para>
30+
</listitem>
31+
<listitem>
32+
<para>
33+
Enabling and disabling &systemd; services is described in
34+
<link xlink:href="https://documentation.suse.com/smart/linux/html/reference-systemctl-enable-disable-services/reference-systemctl-enable-disable-services.html"/>.
35+
</para>
36+
</listitem>
37+
<listitem>
38+
<para>
39+
Managing &systemd; targets with <command>systemctl</command> is described in
40+
<link xlink:href="https://documentation.suse.com/smart/linux/html/reference-managing-systemd-targets-systemctl/reference-systemctl-managing-targets.html"/>.
41+
</para>
42+
</listitem>
43+
<listitem>
44+
<para>
45+
Sending termination signals to &systemd; services is described in
46+
<link xlink:href="https://documentation.suse.com/smart/linux/html/task-send-termination-signals-systemd/task-send-termination-signals-systemd.html"/>.
47+
</para>
48+
</listitem>
49+
<listitem>
50+
<para>
51+
Starting and stopping &systemd; services is described in
52+
<link xlink:href="https://documentation.suse.com/smart/linux/html/reference-systemctl-start-stop-services/reference-systemctl-start-stop-services.html"/>.
53+
</para>
54+
</listitem>
55+
</itemizedlist>
56+
</topic>

‎glues/virtualization-more-info.xml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE topic
3+
[
4+
<!ENTITY % entities SYSTEM "../xml/generic-entities.ent">
5+
%entities;
6+
]>
7+
<topic xml:id="glue-alp-containers-podman-more-info"
8+
role="glue" xml:lang="en"
9+
xmlns="http://docbook.org/ns/docbook" version="5.2"
10+
xmlns:its="http://www.w3.org/2005/11/its"
11+
xmlns:xi="http://www.w3.org/2001/XInclude"
12+
xmlns:xlink="http://www.w3.org/1999/xlink"
13+
xmlns:trans="http://docbook.org/ns/transclusion">
14+
<title>For more information</title>
15+
<info>
16+
<meta name="maintainer" content="tbazant@suse.com"/>
17+
</info>
18+
<para>
19+
For further steps in virtualization, refer to the following sources:
20+
</para>
21+
<itemizedlist>
22+
<listitem>
23+
<para>
24+
<link
25+
xlink:href="https://documentation.suse.com/smart/virtualization-cloud/html/concept-manage-virtual-machines-libvirt/concept-manage-virtual-machines-libvirt.html">Managing
26+
virtual machines with &libvirt;</link>
27+
</para>
28+
</listitem>
29+
<listitem>
30+
<para>
31+
<link xlink:href="https://documentation.suse.com/smart/virtualization-cloud/html/task-configure-virtual-machine-manager/task-configure-virtual-machine-manager.html">Configuring
32+
Virtual Machines with &vmm;</link>
33+
</para>
34+
</listitem>
35+
<listitem>
36+
<para>
37+
<link xlink:href="https://documentation.suse.com/smart/virtualization-cloud/html/vm-assign-pci-device/vm-assign-pci-device.html">Assigning
38+
Host Devices to Virtual Machines</link>
39+
</para>
40+
</listitem>
41+
<listitem>
42+
<para>
43+
<link xlink:href="https://documentation.suse.com/smart/virtualization-cloud/html/virtual-disk-cache-mode-configure/virtual-disk-cache-mode-configure.html">Configuring
44+
a Virtual Disk Cache Mode</link>
45+
</para>
46+
</listitem>
47+
<listitem>
48+
<para>
49+
<link xlink:href="https://documentation.suse.com/smart/virtualization-cloud/html/virt-scenario-creating-customized-vm-guests/index.html">Creating
50+
Customized Virtual Machines Using virt-scenario</link>
51+
</para>
52+
</listitem>
53+
</itemizedlist>
54+
</topic>

‎glues/vm-assign-pci-device-intro.xml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@
1919
&libvirt; is a unified interface to multiple virtualization solutions. &libvirt; virtual
2020
machines are typically managed by either &virsh;, a command-line utility, or &vmm;, an
2121
application with a graphical user interface. Assigning &vmhost;'s PCI or USB devices to a
22-
&vmguest;&mdash;also known as &pciback;&mdash;dedicates the device's resources to the
23-
&vmguest;. After the device is assigned, it cannot be used by the &vmhost; or by any other
24-
&vmguest; on the same &vmhost;. This article describes how to assign a &vmhost;'s device to a
25-
&vmguest; using both the &virsh; command-line utility and the &vmm; GUI application.
22+
&vmguest; dedicates the device's resources to the &vmguest;. The reasons for assigning a host
23+
device to a VM are near-native performance of the device, using its hardware acceleration
24+
capabilities, or isolating the device from other VMs to increase security.
25+
</para>
26+
<para>
27+
This article describes how to assign a &vmhost;'s device to a &vmguest; using both the &virsh;
28+
command-line utility and the &vmm; GUI application.
2629
</para>
2730
</topic>

0 commit comments

Comments
 (0)