This sections contains topics to consider when using SELinux with your virtualization deployment. When you deploy system changes or add devices, you must update your SELinux policy accordingly. To configure an LVM volume for a guest, you must modify the SELinux context for the respective underlying block device and volume group.
# semanage fcontext -a -t virt_image _t -f -b /dev/sda2
# restorecon /dev/sda2
There are several SELinux Booleans which affect KVM and libvirt. These Booleans are listed below for your convenience.
KVM SELinux Booleans
| SELinux Boolean | Description |
|---|
| allow_unconfined_qemu_transition | Default: off. This Boolean controls whether KVM guests can be transitioned to unconfined users. |
| qemu_full_network | Default: on. This Boolean controls full network access to KVM guests. |
| qemu_use_cifs | Default: on. This Boolean controls KVM's access to CIFS or Samba file systems. |
| qemu_use_comm | Default: off. This Boolean controls whether KVM can access serial or parallel communications ports. |
| qemu_use_nfs | Default: on. This Boolean controls KVM's access to NFS file systems. |
