0

I've KVM hypervisor with (Software Raid1) and I've few created VMs .. Does Enable "SELinux" IN the host affects badly on Raid1 and The guests (VMs) ? or there is no relation?

Is it a recommended approach?

Actually, I've it enabled by default to 'enforcing" mode but what I noticed is when I tried to disable the SELinux for a specific guest (Inside it) then I used it and did some actions inside Like creating/modifying files, folders,...etc :

  • I shutdown the guest using virsh shutdown ...
  • I booted it again, but the surprise is it has started with SELinux enabled and I didn't find any of the files and folders those I used before shutdowning the guest!!
Jason4Ever
  • 111
  • 1
  • 6
  • SELinux on the host doesn't cause issues in the guests. You should [read this](https://meta.stackexchange.com/q/66377/189912) and only after having done so, reformulate your question. – Michael Hampton Apr 08 '18 at 23:21

1 Answers1

0

When using KVM (and full machine virtualization in general), the guest OS has a completely separate kernel from the host OS. As such settings for SELinux in the host, have no interaction with settings for SELinux in the guest, or vica-verca.

In the host, when using libvirt & KVM, SELinux is used to confine the QEMU binary, such that any attempt to break out of the guest are blocked. The recommendation of course is to have SELinux set enforcing in both host & guest to maximise your level of protection.

DanielB
  • 1,618
  • 7
  • 7