1virtd_selinux(8) SELinux Policy virtd virtd_selinux(8)
2
6 virtd_selinux - Security Enhanced Linux Policy for the virtd processes
7
9 Security-Enhanced Linux secures the virtd processes via flexible manda‐
10 tory access control.
11 The virtd processes execute with the virtd_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15 For example:
17 ps -eZ | grep virtd_t
19
23 The virtd_t SELinux type can be entered via the virtd_exec_t file type.
24 The default entrypoint paths for the virtd_t domain are the following:
26 /usr/bin/virt-who, /usr/sbin/libvirtd, /usr/bin/imgfac.py,
28 /usr/sbin/virtlockd, /usr/share/vdsm/vdsm, /usr/bin/imagefactory,
29 /usr/bin/nova-compute, /usr/bin/qemu-pr-helper,
30 /usr/share/vdsm/respawn, /usr/sbin/condor_vm-gahp, /usr/bin/vios-proxy-
31 host, /usr/bin/vios-proxy-guest, /usr/share/vdsm/daemonAdapter,
32 /usr/share/vdsm/supervdsmServer
33
35 SELinux defines process types (domains) for each process running on the
36 system
37 You can see the context of a process using the -Z option to ps
39 Policy governs the access confined processes have to files. SELinux
41 virtd policy is very flexible allowing users to setup their virtd pro‐
42 cesses in as secure a method as possible.
43 The following process types are defined for virtd:
45 virtd_t, virt_qmf_t, virt_bridgehelper_t, virt_qemu_ga_t, virtd_lxc_t, virt_qemu_ga_unconfined_t
47 Note: semanage permissive -a virtd_t can be used to make the process
49 type virtd_t permissive. SELinux does not deny access to permissive
50 process types, but the AVC (SELinux denials) messages are still gener‐
51 ated.
52
55 SELinux policy is customizable based on least access required. virtd
56 policy is extremely flexible and has several booleans that allow you to
57 manipulate the policy and run virtd with the tightest access possible.
58 If you want to allow virtual processes to run as userdomains, you must
62 turn on the virt_transition_userdomain boolean. Disabled by default.
63 setsebool -P virt_transition_userdomain 1
65 If you want to allow confined virtual guests to manage nfs files, you
69 must turn on the virt_use_nfs boolean. Disabled by default.
70 setsebool -P virt_use_nfs 1
72 If you want to allow confined virtual guests to manage cifs files, you
76 must turn on the virt_use_samba boolean. Disabled by default.
77 setsebool -P virt_use_samba 1
79 If you want to allow users to resolve user passwd entries directly from
83 ldap rather then using a sssd server, you must turn on the authlo‐
84 gin_nsswitch_use_ldap boolean. Disabled by default.
85 setsebool -P authlogin_nsswitch_use_ldap 1
87 If you want to allow all daemons to write corefiles to /, you must turn
91 on the daemons_dump_core boolean. Disabled by default.
92 setsebool -P daemons_dump_core 1
94 If you want to enable cluster mode for daemons, you must turn on the
98 daemons_enable_cluster_mode boolean. Enabled by default.
99 setsebool -P daemons_enable_cluster_mode 1
101 If you want to allow all daemons to use tcp wrappers, you must turn on
105 the daemons_use_tcp_wrapper boolean. Disabled by default.
106 setsebool -P daemons_use_tcp_wrapper 1
108 If you want to allow all daemons the ability to read/write terminals,
112 you must turn on the daemons_use_tty boolean. Disabled by default.
113 setsebool -P daemons_use_tty 1
115 If you want to deny user domains applications to map a memory region as
119 both executable and writable, this is dangerous and the executable
120 should be reported in bugzilla, you must turn on the deny_execmem bool‐
121 ean. Enabled by default.
122 setsebool -P deny_execmem 1
124 If you want to deny any process from ptracing or debugging any other
128 processes, you must turn on the deny_ptrace boolean. Enabled by
129 default.
130 setsebool -P deny_ptrace 1
132 If you want to allow any process to mmap any file on system with
136 attribute file_type, you must turn on the domain_can_mmap_files bool‐
137 ean. Enabled by default.
138 setsebool -P domain_can_mmap_files 1
140 If you want to allow all domains write to kmsg_device, while kernel is
144 executed with systemd.log_target=kmsg parameter, you must turn on the
145 domain_can_write_kmsg boolean. Disabled by default.
146 setsebool -P domain_can_write_kmsg 1
148 If you want to allow all domains to use other domains file descriptors,
152 you must turn on the domain_fd_use boolean. Enabled by default.
153 setsebool -P domain_fd_use 1
155 If you want to allow all domains to have the kernel load modules, you
159 must turn on the domain_kernel_load_modules boolean. Disabled by
160 default.
161 setsebool -P domain_kernel_load_modules 1
163 If you want to allow all domains to execute in fips_mode, you must turn
167 on the fips_mode boolean. Enabled by default.
168 setsebool -P fips_mode 1
170 If you want to enable reading of urandom for all domains, you must turn
174 on the global_ssp boolean. Disabled by default.
175 setsebool -P global_ssp 1
177 If you want to allow confined applications to run with kerberos, you
181 must turn on the kerberos_enabled boolean. Enabled by default.
182 setsebool -P kerberos_enabled 1
184 If you want to control the ability to mmap a low area of the address
188 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
189 the mmap_low_allowed boolean. Disabled by default.
190 setsebool -P mmap_low_allowed 1
192 If you want to allow system to run with NIS, you must turn on the
196 nis_enabled boolean. Disabled by default.
197 setsebool -P nis_enabled 1
199 If you want to allow confined applications to use nscd shared memory,
203 you must turn on the nscd_use_shm boolean. Disabled by default.
204 setsebool -P nscd_use_shm 1
206 If you want to disable kernel module loading, you must turn on the
210 secure_mode_insmod boolean. Enabled by default.
211 setsebool -P secure_mode_insmod 1
213 If you want to boolean to determine whether the system permits loading
217 policy, setting enforcing mode, and changing boolean values. Set this
218 to true and you have to reboot to set it back, you must turn on the
219 secure_mode_policyload boolean. Enabled by default.
220 setsebool -P secure_mode_policyload 1
222 If you want to allow unconfined executables to make their heap memory
226 executable. Doing this is a really bad idea. Probably indicates a
227 badly coded executable, but could indicate an attack. This executable
228 should be reported in bugzilla, you must turn on the selin‐
229 uxuser_execheap boolean. Disabled by default.
230 setsebool -P selinuxuser_execheap 1
232 If you want to allow all unconfined executables to use libraries
236 requiring text relocation that are not labeled textrel_shlib_t, you
237 must turn on the selinuxuser_execmod boolean. Enabled by default.
238 setsebool -P selinuxuser_execmod 1
240 If you want to allow unconfined executables to make their stack exe‐
244 cutable. This should never, ever be necessary. Probably indicates a
245 badly coded executable, but could indicate an attack. This executable
246 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
247 stack boolean. Enabled by default.
248 setsebool -P selinuxuser_execstack 1
250 If you want to support X userspace object manager, you must turn on the
254 xserver_object_manager boolean. Enabled by default.
255 setsebool -P xserver_object_manager 1
257
261 SELinux defines port types to represent TCP and UDP ports.
262 You can see the types associated with a port by using the following
264 command:
265 semanage port -l
267 Policy governs the access confined processes have to these ports.
270 SELinux virtd policy is very flexible allowing users to setup their
271 virtd processes in as secure a method as possible.
272 The following port types are defined for virtd:
274 virt_migration_port_t
277 Default Defined Ports:
281 tcp 49152-49216
282 virt_port_t
285 Default Defined Ports:
289 tcp 16509,16514
290 udp 16509,16514
291
293 The SELinux process type virtd_t can manage files labeled with the fol‐
294 lowing file types. The paths listed are the default paths for these
295 file types. Note the processes UID still need to have DAC permissions.
296 file_type
298 all files on the system
300
303 SELinux requires files to have an extended attribute to define the file
304 type.
305 You can see the context of a file using the -Z option to ls
307 Policy governs the access confined processes have to these files.
309 SELinux virtd policy is very flexible allowing users to setup their
310 virtd processes in as secure a method as possible.
311 STANDARD FILE CONTEXT
313 SELinux defines the file context types for the virtd, if you wanted to
315 store files with these types in a diffent paths, you need to execute
316 the semanage command to sepecify alternate labeling and then use
317 restorecon to put the labels on disk.
318 semanage fcontext -a -t virtd_unit_file_t '/srv/myvirtd_content(/.*)?'
320 restorecon -R -v /srv/myvirtd_content
321 Note: SELinux often uses regular expressions to specify labels that
323 match multiple files.
324 The following file types are defined for virtd:
326 virtd_exec_t
330 - Set files with the virtd_exec_t type, if you want to transition an
332 executable to the virtd_t domain.
333 Paths:
336 /usr/bin/virt-who, /usr/sbin/libvirtd, /usr/bin/imgfac.py,
337 /usr/sbin/virtlockd, /usr/share/vdsm/vdsm, /usr/bin/imagefactory,
338 /usr/bin/nova-compute, /usr/bin/qemu-pr-helper,
339 /usr/share/vdsm/respawn, /usr/sbin/condor_vm-gahp, /usr/bin/vios-
340 proxy-host, /usr/bin/vios-proxy-guest, /usr/share/vdsm/daemon‐
341 Adapter, /usr/share/vdsm/supervdsmServer
342 virtd_initrc_exec_t
345 - Set files with the virtd_initrc_exec_t type, if you want to transi‐
347 tion an executable to the virtd_initrc_t domain.
348 virtd_keytab_t
352 - Set files with the virtd_keytab_t type, if you want to treat the
354 files as kerberos keytab files.
355 virtd_lxc_exec_t
359 - Set files with the virtd_lxc_exec_t type, if you want to transition
361 an executable to the virtd_lxc_t domain.
362 virtd_unit_file_t
366 - Set files with the virtd_unit_file_t type, if you want to treat the
368 files as virtd unit content.
369 Paths:
372 /usr/lib/systemd/system/.*xen.*.service, /usr/lib/systemd/sys‐
373 tem/virt.*.service, /usr/lib/systemd/system/libvirt.*.service
374 Note: File context can be temporarily modified with the chcon command.
377 If you want to permanently change the file context you need to use the
378 semanage fcontext command. This will modify the SELinux labeling data‐
379 base. You will need to use restorecon to apply the labels.
380
383 semanage fcontext can also be used to manipulate default file context
384 mappings.
385 semanage permissive can also be used to manipulate whether or not a
387 process type is permissive.
388 semanage module can also be used to enable/disable/install/remove pol‐
390 icy modules.
391 semanage port can also be used to manipulate the port definitions
393 semanage boolean can also be used to manipulate the booleans
395 system-config-selinux is a GUI tool available to customize SELinux pol‐
398 icy settings.
399
402 This manual page was auto-generated using sepolicy manpage .
403
406 selinux(8), virtd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8)
407 , setsebool(8), virt_bridgehelper_selinux(8), virt_qemu_ga_selinux(8),
408 virt_qemu_ga_unconfined_selinux(8), virt_qmf_selinux(8),
409 virtd_lxc_selinux(8)
410virtd 19-04-25 virtd_selinux(8)