Walsh: Secure Virtualization Using SELinux (sVirt)

> I don't consider _any_ generic, out-of-the-box distro config to be
> reasonable (for AA or for SELinux). the specifics of what a particular
> service needs to do can change so drasticly from one application to
> another that there is no chance that a generic config can both protect the
> system and be broad enough to allow everything to work.

This may have been accurate in previous version of Fedora <= 10), but this is a problem we explicitly tried to address in the sVirt project for Fedora >= 11.

For example, in old way of doing things in Fedora 10, the policy required that all QEMU/KVM disk images lived under /var/lib/libvirt/images. To deviate from this, the admin would need to manually change the policy or relabel files.

In Fedora 11 with the introduction of sVirt, libvirtd itself takes care of all disk labelling. So no matter where you, as an admin, decide to place files for virtual disks, libvirtd will set the correct labelling. It will also set correct labelling if you give a guest a physical disk/partition from the host. So the admin does not have to do any manual labelling of disks, nor are they restricted in where they can store them.

In Fedora 12, the automatic labelling is being taken further, so that libvirt will set correct labelling for any host USB or PCI devices that are assigned to the guest OS, removing another configuration from the admin.

This is the benefit of integrating SELinux support directly into applications, instead of having it applied as a separate layer - you are no longer restricted to a static policy.