Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

19.2. SELinux and virtualization

Security Enhanced Linux was developed by the NSA with assistance from the Linux community to provide stronger security for Linux. SELinux limits an attackers abilities and works to prevent many common security exploits such as buffer overflow attacks and privilege escalation. It is because of these benefits that Red Hat recommends all Red Hat Enterprise Linux systems should run with SELinux enabled and in enforcing mode.
SELinux prevents guest images from loading if SELinux is enabled and the images are not correctly labeled. SELinux requires that image files have the virt_image_t label applied to them. The /var/lib/libvirt/images directory has this label applied to it and its contents by default. This does not mean that images must be stored in this directory; images can be stored anywhere, provided they are labeled with virt_image_t.
Adding LVM based storage with SELinux in enforcing mode

The following section is an example of adding a logical volume to a guest with SELinux enabled. These instructions also work for hard drive partitions.

Procedure 19.1. Creating and mounting a logical volume on a guest with SELinux enabled

  1. Create a logical volume. This example creates a 5 gigabyte logical volume named NewVolumeName on the volume group named volumegroup. 
    # lvcreate -n NewVolumeName -L 5G volumegroup
    Copy to Clipboard Toggle word wrap
  2. Format the NewVolumeName logical volume with a file system that supports extended attributes, such as ext3. 
    # mke2fs -j /dev/volumegroup/NewVolumeName
    Copy to Clipboard Toggle word wrap
  3. Create a new directory for mounting the new logical volume. This directory can be anywhere on your file system. It is advised not to put it in important system directories (/etc, /var, /sys) or in home directories (/home or /root). This example uses a directory called /virtstorage 
    # mkdir /virtstorage
    Copy to Clipboard Toggle word wrap
  4. Mount the logical volume. 
    # mount /dev/volumegroup/NewVolumeName /virtstorage
    Copy to Clipboard Toggle word wrap
  5. Set the correct SELinux type for a Xen folder. 
    semanage fcontext -a -t xen_image_t "/virtstorage(/.*)?"
    Copy to Clipboard Toggle word wrap
    Alternatively, set the correct SELinux type for a KVM folder. 
    semanage fcontext -a -t virt_image_t "/virtstorage(/.*)?"
    Copy to Clipboard Toggle word wrap
    If the targeted policy is used (targeted is the default policy) the command appends a line to the /etc/selinux/targeted/contexts/files/file_contexts.local file which makes the change persistent. The appended line may resemble this: 
    /virtstorage(/.*)?    system_u:object_r:xen_image_t:s0
    Copy to Clipboard Toggle word wrap
  6. Label the device node (for example, /dev/volumegroup/NewVolumeName with the correct label: 
    # semanage fcontext -a -t xen_image_t /dev/volumegroup/NewVolumeName
# restorecon /dev/volumegroup/NewVolumeName
    Copy to Clipboard Toggle word wrap
Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat