svirt_tcg_selinux(8)

💅 svirt_tcg_selinux — the SELinux glow-up for your svirt_tcg processes ✨

Okay bestie, so like, you know how your svirt_tcg processes need to be secure but also need to live their best life? That's literally what this manual page is about — it's svirt_tcg_selinux(8) from the SELinux Policy svirt_tcg squad. Let's get into it. 🫶

---

🌸 NAME 🌸

svirt_tcg_selinux — the Security Enhanced Linux Policy for the svirt_tcg processes, aka the security bouncer for your virtual machines. No cap.

---

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the svirt_tcg processes via flexible mandatory access control — it's giving strict but fair energy. 💅

The svirt_tcg processes execute with the svirt_tcg_t SELinux type. Wanna check if you've got these processes running? Just run the ps command with the -Z qualifier, like this:

ps -eZ | grep svirt_tcg_t

That's literally it. Iconic. 🔥

---

🚪 ENTRYPOINTS 🚪

The svirt_tcg_t SELinux type can be entered via the qemu_exec_t file type — that's the VIP entrance, iykyk.

The default entrypoint paths for the svirt_tcg_t domain are, and I'm quoting exactly:

/usr/libexec/qemu.*, /usr/bin/qemu-system-.*, /usr/bin/qemu,
/usr/bin/qemu-kvm

Slay. Those are the doors. 🎀

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system — it's like every process gets its own little personality. 🌈

You can peep the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. The SELinux svirt_tcg policy is very flexible, allowing users to set up their svirt_tcg processes in as secure a method as possible — maximum security and maximum flexibility, we love to see it. 💖

The following process types are defined for svirt_tcg:

• svirt_tcg_t

Note: semanage permissive -a svirt_tcg_t can be used to make the process type svirt_tcg_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. It's like a warning card, not a full stop. 🙈

---

🔐 MCS Constrained 🔐

The SELinux process type svirt_tcg_t is an MCS (Multi Category Security) constrained type. Sometimes this separation is referred to as sVirt — fancy, right? These types are usually used for securing multi-tenant environments, such as virtualization, containers, or separation of users. The tools used to launch MCS types pick out a different MCS label for each process group, like handing out different colored wristbands at a party. 🎉

For example, one process might be launched with svirt_tcg_t:s0:c1,c2, and another process launched with svirt_tcg_t:s0:c3,c4. The SELinux kernel only allows these processes to write to content with a matching MCS label, or an MCS Label of s0. A process running with the MCS level of s0:c1,c2 is not allowed to write to content with the MCS label of s0:c3,c4 — the vibes are not matching, so no writes for you. 🚫

---

🎛️ BOOLEANS 🎛️

SELinux policy is customizable based on least access required — the less access, the better, periodt. The svirt_tcg policy is extremely flexible and has several booleans that allow you to manipulate the policy and run svirt_tcg with the tightest access possible. 🔒

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow confined virtual guests to interact with rawip sockets, you must turn on the virt_use_rawip boolean. Disabled by default.

setsebool -P virt_use_rawip 1

Two booleans, two commands, easy peasy. 🍓

---

📁 MANAGED FILES 📁

The SELinux process type svirt_tcg_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the processes UID still need to have DAC permissions — SELinux isn't doing all the work, bestie. 😭

• fs_t
• glusterd_var_run_t

/run/gluster(/.*)?
/run/glusterd.*
/run/glusterd.*
/run/glusterd(/.*)?

• qemu_var_run_t

/run/libvirt/qemu(/.*)?
/var/lib/libvirt/qemu(/.*)?

• svirt_home_t

/home/[^/]+/.libvirt/qemu(/.*)?
/home/[^/]+/.cache/libvirt/qemu(/.*)?
/home/[^/]+/.config/libvirt/qemu(/.*)?
/home/[^/]+/.local/share/libvirt/boot(/.*)?
/home/[^/]+/.local/share/libvirt/images(/.*)?
/home/[^/]+/.local/share/gnome-boxes/images(/.*)?

• svirt_image_t
• svirt_tmp_t
• svirt_tmpfs_t
• virt_cache_t

/var/cache/oz(/.*)?
/var/cache/libvirt(/.*)?

That's the whole list — every file type, every path, nothing skipped. You're welcome. 💜

---

💻 COMMANDS 💻

Okay so there are a bunch of semanage commands you can use to tweak things, and they're all lowkey iconic:

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.

And system-config-selinux is a GUI tool available to customize SELinux policy settings — for when you want to click instead of type. 🖱️✨

---

✍️ AUTHOR ✍️

This manual page was auto-generated using sepolicy manpage. No human author to thank, just the machines. 💀

---

🔗 SEE ALSO 🔗

selinux(8), svirt_tcg(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8) — go read those if you're hungry for more. 📚

---

And that's the whole page, besties! 🦋 This little gem came straight from the SELinux Policy svirt_tcg collection, dated 26-10-06, and it's filed under svirt_tcg_selinux(8). Go forth and configure responsibly. 👑💖