19.2. SELinux and virtualization

Procedure 19.1. Creating and mounting a logical volume on a guest with SELinux enabled

1. Create a logical volume. This example creates a 5 gigabyte logical volume named NewVolumeName on the volume group named volumegroup.

   # lvcreate -n NewVolumeName -L 5G volumegroup

   Copy to Clipboard
2. Format the NewVolumeName logical volume with a file system that supports extended attributes, such as ext3.

   # mke2fs -j /dev/volumegroup/NewVolumeName

   Copy to Clipboard
3. Create a new directory for mounting the new logical volume. This directory can be anywhere on your file system. It is advised not to put it in important system directories (/etc, /var, /sys) or in home directories (/home or /root). This example uses a directory called /virtstorage

   # mkdir /virtstorage

   Copy to Clipboard
4. Mount the logical volume.

   # mount /dev/volumegroup/NewVolumeName /virtstorage

   Copy to Clipboard
5. Set the correct SELinux type for a Xen folder.

   semanage fcontext -a -t xen_image_t "/virtstorage(/.*)?"
   

   Copy to Clipboard
   Alternatively, set the correct SELinux type for a KVM folder.

   semanage fcontext -a -t virt_image_t "/virtstorage(/.*)?"
   

   Copy to Clipboard
   If the targeted policy is used (targeted is the default policy) the command appends a line to the /etc/selinux/targeted/contexts/files/file_contexts.local file which makes the change persistent. The appended line may resemble this:

   /virtstorage(/.*)?    system_u:object_r:xen_image_t:s0
   

   Copy to Clipboard
6. Label the device node (for example, /dev/volumegroup/NewVolumeName with the correct label:

   # semanage fcontext -a -t xen_image_t /dev/volumegroup/NewVolumeName
   # restorecon /dev/volumegroup/NewVolumeName
   

   Copy to Clipboard