diff --git a/man/tuned-adm.8 b/man/tuned-adm.8
index 7b2b693..01dcd18 100644
--- a/man/tuned-adm.8
+++ b/man/tuned-adm.8
@@ -138,6 +138,18 @@ Profile optimized for virtual hosts based on throughput-performance profile.
It additionally enables more aggresive writeback of dirty pages.
.TP
+.BI "atomic-guest"
+Profile optimized for virtual Atomic guests. It is based on virtual-guest
+profile. It additionally increases SELinux AVC cache, PID limit and tunes
+netfilter connections tracking.
+
+.TP
+.BI "atomic-host"
+Profile optimized for Atomic hosts. It is based on throughput-performance
+profile. It additionally increases SELinux AVC cache, PID limit and tunes
+netfilter connections tracking.
+
+.TP
.BI "sap"
Profile optimized for the best performance of SAP software. It is based on
throughput-performance profile. It additionally tunes sysctl settings
diff --git a/profiles/atomic-guest/tuned.conf b/profiles/atomic-guest/tuned.conf
new file mode 100644
index 0000000..aff05f2
--- /dev/null
+++ b/profiles/atomic-guest/tuned.conf
@@ -0,0 +1,16 @@
+#
+# tuned configuration
+#
+
+[main]
+include=virtual-guest
+
+[selinux]
+avc_cache_threshold=65536
+
+[net]
+nf_conntrack_hashsize=131072
+
+[sysctl]
+kernel.pid_max=131072
+net.netfilter.nf_conntrack_max=1048576
diff --git a/profiles/atomic-host/tuned.conf b/profiles/atomic-host/tuned.conf
new file mode 100644
index 0000000..ad223bd
--- /dev/null
+++ b/profiles/atomic-host/tuned.conf
@@ -0,0 +1,16 @@
+#
+# tuned configuration
+#
+
+[main]
+include=throughput-performance
+
+[selinux]
+avc_cache_threshold=65536
+
+[net]
+nf_conntrack_hashsize=131072
+
+[sysctl]
+kernel.pid_max=131072
+net.netfilter.nf_conntrack_max=1048576
diff --git a/recommend.conf b/recommend.conf
index d01ebdf..45eed36 100644
--- a/recommend.conf
+++ b/recommend.conf
@@ -7,6 +7,14 @@
# If 'virt' or 'system' is empty, i.e. 'virt=', it matches only empty string (alias for '^$').
# If several profiles matched, the first match is taken.
+[atomic-host]
+virt=
+system=.*atomic.*
+
+[atomic-guest]
+virt=.+
+system=.*atomic.*
+
[throughput-performance]
virt=
system=.*(computenode|server).*
diff --git a/tuned/plugins/plugin_net.py b/tuned/plugins/plugin_net.py
index 57e4265..b9a60b4 100644
--- a/tuned/plugins/plugin_net.py
+++ b/tuned/plugins/plugin_net.py
@@ -75,6 +75,7 @@ class NetTuningPlugin(base.Plugin):
def _get_config_options(cls):
return {
"wake_on_lan": None,
+ "nf_conntrack_hashsize": None,
}
def _init_stats_and_idle(self, instance, device):
@@ -121,6 +122,10 @@ class NetTuningPlugin(base.Plugin):
# speed / 7 Mb -> MB
return (int) (0.6 * 1024 * 1024 * speed / 8)
+ @classmethod
+ def _nf_conntrack_hashsize_path(self):
+ return "/sys/module/nf_conntrack/parameters/hashsize"
+
@command_set("wake_on_lan", per_device=True)
def _set_wake_on_lan(self, value, device):
if value is None:
@@ -144,3 +149,19 @@ class NetTuningPlugin(base.Plugin):
except IOError:
pass
return value
+
+ @command_set("nf_conntrack_hashsize")
+ def _set_nf_conntrack_hashsize(self, value):
+ if value is None:
+ return
+
+ hashsize = int(value)
+ if hashsize >= 0:
+ tuned.utils.commands.write_to_file(self._nf_conntrack_hashsize_path(), hashsize)
+
+ @command_get("nf_conntrack_hashsize")
+ def _get_nf_conntrack_hashsize(self):
+ value = tuned.utils.commands.read_file(self._nf_conntrack_hashsize_path())
+ if len(value) > 0:
+ return int(value)
+ return None
diff --git a/tuned/plugins/plugin_selinux.py b/tuned/plugins/plugin_selinux.py
new file mode 100644
index 0000000..757ecf7
--- /dev/null
+++ b/tuned/plugins/plugin_selinux.py
@@ -0,0 +1,55 @@
+import os
+import base
+from decorators import *
+import tuned.logs
+import tuned.utils.commands
+
+log = tuned.logs.get()
+
+class SelinuxPlugin(base.Plugin):
+ """
+ Plugin for tuning SELinux options.
+ """
+
+ @classmethod
+ def _get_selinux_path(self):
+ path = "/sys/fs/selinux"
+ if not os.path.exists(path):
+ path = "/selinux"
+ if not os.path.exists(path):
+ path = None
+ return path
+
+ def __init__(self, *args, **kwargs):
+ self._selinux_path = self._get_selinux_path()
+ if self._selinux_path is None:
+ raise exceptions.NotSupportedPluginException("SELinux is not enabled on your system or incompatible version is used.")
+ self._cache_threshold_path = os.path.join(self._selinux_path, "avc", "cache_threshold")
+ super(self.__class__, self).__init__(*args, **kwargs)
+
+ def _get_config_options(self):
+ return {
+ "avc_cache_threshold" : None,
+ }
+
+ def _instance_init(self, instance):
+ instance._has_static_tuning = True
+ instance._has_dynamic_tuning = False
+
+ def _instance_cleanup(self, instance):
+ pass
+
+ @command_set("avc_cache_threshold")
+ def _set_avc_cache_threshold(self, value):
+ if value is None:
+ return
+ threshold = int(value)
+ if threshold >= 0:
+ tuned.utils.commands.write_to_file(self._cache_threshold_path, threshold)
+
+ @command_get("avc_cache_threshold")
+ def _get_avc_cache_threshold(self):
+ value = tuned.utils.commands.read_file(self._cache_threshold_path)
+ if len(value) > 0:
+ return int(value)
+ return None