qemu_dm_selinux(8)

💅 qemu_dm_selinux(8) — the SELinux tea for your qemu_dm girlies

okay so bestie, this is the manual page for qemu_dm_selinux, and it's all about the SELinux policy that wraps up your qemu_dm processes. it lives in section 8 of the manual, iykyk. let's get into it 🫶

---

✨ NAME ✨

qemu_dm_selinux — the Security Enhanced Linux Policy for the qemu_dm processes. literally that's it, that's the whole name. iconic behavior honestly 💅

---

🦋 DESCRIPTION 🦋

so like, Security-Enhanced Linux secures the qemu_dm processes via flexible mandatory access control. yes bestie, mandatory — not the vibes-based discretionary kind. it's giving strict parent energy and honestly? it works.

the qemu_dm processes execute with the qemu_dm_t SELinux type. you can check if you actually have these processes running by executing the ps command with the -Z qualifier.

for example:

ps -eZ | grep qemu_dm_t

run that and see who's wearing the qemu_dm_t fit 😌

---

🚪 ENTRYPOINTS 🚪

the qemu_dm_t SELinux type can be entered via the qemu_dm_exec_t file type. that's the doorway, that's the entrance, that's how you get in 🚪✨

the default entrypoint paths for the qemu_dm_t domain are the following:

(...and then the list is just. empty. nothing. a whole lot of nothing. the page lists no default entrypoint paths at all, so don't @ me — there are literally none written down here 🫥)

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. yes, every single one gets a little domain, they're all main characters in their own way 💜

you can see the context of a process using the -Z option to ps.

policy governs the access confined processes have to files. the SELinux qemu_dm policy is very flexible, allowing users to setup their qemu_dm processes in as secure a method as possible.

the following process types are defined for qemu_dm:

• qemu_dm_t

note: semanage permissive -a qemu_dm_t can be used to make the process type qemu_dm_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill but it's still snitching in the logs. no cap 💀

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. the qemu_dm policy is extremely flexible and has several booleans that allow you to manipulate the policy and run qemu_dm with the tightest access possible. tightest access = cleanest look, periodt ✨

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

if you want to allow xend to run qemu-dm — and heads up, this is not required if using paravirt and no vfb — you must turn on the xend_run_qemu boolean. Enabled by default.

setsebool -P xend_run_qemu 1

see how both of those are already on by default? she came ready 👑 ngl that's a serve.

---

📂 MANAGED FILES 📂

the SELinux process type qemu_dm_t can manage files labeled with the following file types. the paths listed are the default paths for these file types.

important bestie: the process's UID still needs to have DAC permissions. SELinux being cool with it does not mean your user is. two different bouncers, two different guest lists 🙈

• xenfs_t — (no default paths listed for this one on this page, so it's just the type name, standing there, looking cute 🧚)

---

⚡ COMMANDS ⚡

here's your toolbox, your little kit of slay tools 🎀

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules. yes, all four. she does it all 💅
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. for the girlies who like a little visual moment 🖱️✨

---

🌸 AUTHOR 🌸

this manual page was auto-generated using sepolicy manpage . — yes, machine-made, but make it fashion 🤖💖

---

🌈 SEE ALSO 🌈

go read these next, fr fr, they're all linked up in the group chat:

selinux(8), qemu_dm(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

okay that's the whole page bestie, you're officially educated 💖 this was the qemu_dm SELinux policy page, dated 26-10-06 — go forth, check your contexts, and stay permissive only when you mean it. byeee 🦋💅