19.2. SELinux and virtualization
virt_image_tlabel applied to them. The
/var/lib/libvirt/imagesdirectory has this label applied to it and its contents by default. This does not mean that images must be stored in this directory; images can be stored anywhere, provided they are labeled with
The following section is an example of adding a logical volume to a guest with SELinux enabled. These instructions also work for hard drive partitions.
Procedure 19.1. Creating and mounting a logical volume on a guest with SELinux enabled
- Create a logical volume. This example creates a 5 gigabyte logical volume named
NewVolumeNameon the volume group named
# lvcreate -n
- Format the
NewVolumeNamelogical volume with a file system that supports extended attributes, such as ext3.
# mke2fs -j
- Create a new directory for mounting the new logical volume. This directory can be anywhere on your file system. It is advised not to put it in important system directories (
/sys) or in home directories (
/root). This example uses a directory called
- Mount the logical volume.
- Set the correct SELinux type for a Xen folder.
semanage fcontext -a -t xen_image_t "/virtstorage(/.*)?"Alternatively, set the correct SELinux type for a KVM folder.
semanage fcontext -a -t virt_image_t "/virtstorage(/.*)?"If the targeted policy is used (targeted is the default policy) the command appends a line to the
/etc/selinux/targeted/contexts/files/file_contexts.localfile which makes the change persistent. The appended line may resemble this:
- Label the device node (for example,
/dev/volumegroup/NewVolumeNamewith the correct label:
# semanage fcontext -a -t xen_image_t /dev/volumegroup/NewVolumeName # restorecon /dev/volumegroup/NewVolumeName