Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

19.2. SELinux and virtualization

Security Enhanced Linux was developed by the NSA with assistance from the Linux community to provide stronger security for Linux. SELinux limits an attackers abilities and works to prevent many common security exploits such as buffer overflow attacks and privilege escalation. It is because of these benefits that Red Hat recommends all Red Hat Enterprise Linux systems should run with SELinux enabled and in enforcing mode.
SELinux prevents guest images from loading if SELinux is enabled and the images are not correctly labeled. SELinux requires that image files have the virt_image_t label applied to them. The /var/lib/libvirt/images directory has this label applied to it and its contents by default. This does not mean that images must be stored in this directory; images can be stored anywhere, provided they are labeled with virt_image_t.
Adding LVM based storage with SELinux in enforcing mode

The following section is an example of adding a logical volume to a guest with SELinux enabled. These instructions also work for hard drive partitions.

Procedure 19.1. Creating and mounting a logical volume on a guest with SELinux enabled

  1. Create a logical volume. This example creates a 5 gigabyte logical volume named NewVolumeName on the volume group named volumegroup. 
    # lvcreate -n NewVolumeName -L 5G volumegroup
    Copy to Clipboard Toggle word wrap
  2. Format the NewVolumeName logical volume with a file system that supports extended attributes, such as ext3. 
    # mke2fs -j /dev/volumegroup/NewVolumeName
    Copy to Clipboard Toggle word wrap
  3. Create a new directory for mounting the new logical volume. This directory can be anywhere on your file system. It is advised not to put it in important system directories (/etc, /var, /sys) or in home directories (/home or /root). This example uses a directory called /virtstorage 
    # mkdir /virtstorage
    Copy to Clipboard Toggle word wrap
  4. Mount the logical volume. 
    # mount /dev/volumegroup/NewVolumeName /virtstorage
    Copy to Clipboard Toggle word wrap
  5. Set the correct SELinux type for a Xen folder. 
    semanage fcontext -a -t xen_image_t "/virtstorage(/.*)?"
    Copy to Clipboard Toggle word wrap
    Alternatively, set the correct SELinux type for a KVM folder. 
    semanage fcontext -a -t virt_image_t "/virtstorage(/.*)?"
    Copy to Clipboard Toggle word wrap
    If the targeted policy is used (targeted is the default policy) the command appends a line to the /etc/selinux/targeted/contexts/files/file_contexts.local file which makes the change persistent. The appended line may resemble this: 
    /virtstorage(/.*)?    system_u:object_r:xen_image_t:s0
    Copy to Clipboard Toggle word wrap
  6. Label the device node (for example, /dev/volumegroup/NewVolumeName with the correct label: 
    # semanage fcontext -a -t xen_image_t /dev/volumegroup/NewVolumeName
# restorecon /dev/volumegroup/NewVolumeName
    Copy to Clipboard Toggle word wrap
Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2026 Red Hat