In this lesson, you will learn how to use SELinux to enforce strict boundaries between hypervisor processes and the virtual machine (VM) disk images they manage.
Understanding Virtualization Isolation
When you run a virtual machine, the hypervisor process (like qemu-kvm) acts as the gatekeeper between the host kernel and the guest OS. Without SELinux, if a vulnerability exists in the hypervisor, an attacker could potentially read or modify any file on the host. SELinux prevents this by assigning specific types to both the processes and the disk files, ensuring the hypervisor can only interact with the exact files it is authorized to access.
Enforcing Disk Image Access
To protect VM disk images, we use a specialized type: svirt_image_t. When a VM is managed by a framework like libvirt, SELinux automatically assigns a unique, multi-category security (MCS) label to the disk file and the corresponding hypervisor process.
For example, if you list the security context of a virtual disk, you might see:
ls -Z /var/lib/libvirt/images/vm1.qcow2
# output: system_u:object_r:svirt_image_t:s0:c123,c456 /var/lib/libvirt/images/vm1.qcow2
The suffix s0:c123,c456 represents a unique category pair. SELinux ensures that the hypervisor process running that specific VM is restricted to that same category. Even if another hypervisor process is compromised, it cannot access vm1.qcow2 because its process label will not match the required categories.
Restricting the Hypervisor
The hypervisor process itself runs under the svirt_t domain. The SELinux policy defines strict rules for svirt_t, explicitly allowing it to read and write files labeled svirt_image_t only if the categories match. Attempting to bypass this—such as having the hypervisor try to read /etc/shadow—will trigger an AVC denial, as the hypervisor domain lacks the permission to transition to or access files with the shadow_t type.
By combining Type Enforcement (restricting the domain) with Multi-Level Security (isolating the disk categories), you create a "sandbox" that remains secure even if the hypervisor software is misconfigured or exploited.
Key Takeaway: SELinux secures virtualization by labeling VM disk images as svirt_image_t and using MCS category matching to ensure the hypervisor can only access files specifically assigned to that individual VM instance.