Red Hat Bugzilla – Bug 592382
Small typo: xend mentioned instead of kvm in RHEL 6 beta Virtualization Guide
Last modified: 2011-12-05 20:04:08 EST
Description of problem:
"xend" is mentioned in the RHEL 6 beta (April 2010) Virtualization Guide where it should probably say KVM instead:
29.3. Troubleshooting with serial consoles
"logging output with xend is unavailable"
Fixed in build 21. This fix should be live soon.
Same problem here:
Mentions of Xen and dom0:
The host, in the Xen hypervisor, is a privileged domain that handles system
management and manages all virtual machines. If the host is insecure, all
other domains in the system are vulnerable.
+ Use a firewall to restrict traffic to dom0. You can setup a firewall with
default-reject rules that will help secure attacks on dom0. It is also
important to limit network facing services.
+ Do not allow normal users to access dom0. If you do permit normal users dom0
access, you run the risk of rendering dom0 vulnerable. Remember, dom0 is
privileged, and granting unprivileged accounts may compromise the level of
Do you want this filed as a separate bug, or is here ok?
5. Set the correct SELinux type for the Xen folder.
semanage fcontext -a -t xen_image_t "/virtualization(/.*)?"
Alternatively, set the correct SELinux type for a KVM folder.
semanage fcontext -a -t virt_image_t "/virtualization(/.*)?"
Is it worth swapping the Xen and KVM entries around, for first emphasis on KVM?
This looks like a carry over from RHEL 5 as well:
"The Boolean parameter xend_disable_t can set the xend to unconfined mode after restarting the daemon. It is better to disable protection for a single daemon than the whole system. It is advisable that you should not re-label directories as xen_image_t that you will use elsewhere."
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release. Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release. This request is not yet committed for