4.3. sVirt Configuration

SELinux Booleans are variables that can be toggled on or off, quickly enabling or disabling features or other special conditions. Booleans can be toggled by running either setsebool boolean_name {on|off} for a temporary change, or setsebool -P boolean_name {on|off} to make the change persistent across reboots.
The following table shows the SELinux Boolean values that affect KVM when launched by libvirt. The current state of these booleans (on or off) can be found by running the command getsebool -a|grep virt.

Table 4.1. KVM SELinux Booleans

SELinux BooleanDescription
staff_use_svirtAllow staff user to create and transition to sVirt domains.
unprivuser_use_svirtAllow unprivileged user to create and transition to sVirt domains.
virt_sandbox_use_auditAllow sandbox containers to send audit messages.
virt_sandbox_use_netlinkAllow sandbox containers to use netlink system calls.
virt_sandbox_use_sys_adminAllow sandbox containers to use sys_admin system calls, such as mount.
virt_transition_userdomainAllow virtual processes to run as user domains.
virt_use_commAllow virt to use serial/parallel communication ports.
virt_use_execmemAllow confined virtual guests to use executable memory and executable stack.
virt_use_fusefsAllow virt to read FUSE mounted files.
virt_use_nfsAllow virt to manage NFS mounted files.
virt_use_rawipAllow virt to interact with rawip sockets.
virt_use_sambaAllow virt to manage CIFS mounted files.
virt_use_sanlockAllow confined virtual guests to interact with the sanlock.
virt_use_usbAllow virt to use USB devices.
virt_use_xserverAllow virtual machine to interact with the X Window System.

Note

For more information on SELinux Booleans, refer to Red Hat Enterprise Linux Security Enhanced Linux.