19.2. SELinux and virtualization
Security Enhanced Linux was developed by the NSA
with assistance from the Linux community to provide stronger security for Linux. SELinux limits an attackers abilities and works to prevent many common security exploits such as buffer overflow attacks and privilege escalation. It is because of these benefits that Red Hat recommends all Red Hat Enterprise Linux systems should run with SELinux enabled and in enforcing mode.
SELinux prevents guest images from loading if SELinux is enabled and the images are not correctly labeled. SELinux requires that image files have the
virt_image_t label applied to them. The /var/lib/libvirt/images directory has this label applied to it and its contents by default. This does not mean that images must be stored in this directory; images can be stored anywhere, provided they are labeled with virt_image_t.
Adding LVM based storage with SELinux in enforcing mode
The following section is an example of adding a logical volume to a guest with SELinux enabled. These instructions also work for hard drive partitions.
Procedure 19.1. Creating and mounting a logical volume on a guest with SELinux enabled
- Create a logical volume. This example creates a 5 gigabyte logical volume named
NewVolumeNameon the volume group namedvolumegroup.# lvcreate -n
NewVolumeName-L5G volumegroup - Format the
NewVolumeNamelogical volume with a file system that supports extended attributes, such as ext3.# mke2fs -j
/dev/volumegroup/NewVolumeName - Create a new directory for mounting the new logical volume. This directory can be anywhere on your file system. It is advised not to put it in important system directories (
/etc,/var,/sys) or in home directories (/homeor/root). This example uses a directory called/virtstorage# mkdir
/virtstorage - Mount the logical volume.
# mount
/dev/volumegroup/NewVolumeName /virtstorage - Set the correct SELinux type for a Xen folder.
semanage fcontext -a -t xen_image_t "/virtstorage(/.*)?"
Alternatively, set the correct SELinux type for a KVM folder.semanage fcontext -a -t virt_image_t "/virtstorage(/.*)?"
If the targeted policy is used (targeted is the default policy) the command appends a line to the/etc/selinux/targeted/contexts/files/file_contexts.localfile which makes the change persistent. The appended line may resemble this:/virtstorage(/.*)? system_u:object_r:xen_image_t:s0
- Label the device node (for example,
/dev/volumegroup/NewVolumeNamewith the correct label:# semanage fcontext -a -t xen_image_t /dev/volumegroup/NewVolumeName # restorecon /dev/volumegroup/NewVolumeName
