4.3. sVirt Configuration

SELinux Booleans are variables that can be toggled on or off, quickly enabling or disabling features or other special conditions. Booleans can be toggled by running either setsebool boolean_name {on|off} for a temporary change, or setsebool -P boolean_name {on|off} to make the change persistent across reboots.
The following table shows the SELinux Boolean values that affect KVM when launched by libvirt. The current state of these booleans (on or off) can be found by running the command getsebool -a|grep virt.

Table 4.1. KVM SELinux Booleans

SELinux BooleanDescription
staff_use_svirtEnables staff users to create and transition to sVirt domains.
unprivuser_use_svirtEnables unprivileged users to create and transition to sVirt domains.
virt_sandbox_use_auditEnables sandbox containers to send audit messages.
virt_sandbox_use_netlinkEnables sandbox containers to use netlink system calls.
virt_sandbox_use_sys_adminEnables sandbox containers to use sys_admin system calls, such as mount.
virt_transition_userdomainEnables virtual processes to run as user domains.
virt_use_commEnables virt to use serial/parallel communication ports.
virt_use_execmemEnables confined virtual guests to use executable memory and executable stack.
virt_use_fusefsEnables virt to read FUSE mounted files.
virt_use_nfsEnables virt to manage NFS mounted files.
virt_use_rawipEnables virt to interact with rawip sockets.
virt_use_sambaEnables virt to manage CIFS mounted files.
virt_use_sanlockEnables confined virtual guests to interact with the sanlock.
virt_use_usbEnables virt to use USB devices.
virt_use_xserverEnables virtual machine to interact with the X Window System.

Note

For more information on SELinux Booleans, see the Red Hat Enterprise Linux SELinux Users and Administrators Guide.