Fixed in build 21. This fix should be live soon.

Chris

Hi Chris,

Same problem here:

  http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Virtualization/chap-Virtualization-Security_for_virtualization.html

Mentions of Xen and dom0:

  The host, in the Xen hypervisor, is a privileged domain that handles system
  management and manages all virtual machines. If the host is insecure, all
  other domains in the system are vulnerable.

  + Use a firewall to restrict traffic to dom0. You can setup a firewall with
    default-reject rules that will help secure attacks on dom0. It is also
    important to limit network facing services.

  + Do not allow normal users to access dom0. If you do permit normal users dom0
    access, you run the risk of rendering dom0 vulnerable. Remember, dom0 is
    privileged, and granting unprivileged accounts may compromise the level of
    security. 

Do you want this filed as a separate bug, or is here ok?

Similar here:

  http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Virtualization/sect-Virtualization-Security_for_virtualization-SELinux_and_virtualization.html

  5. Set the correct SELinux type for the Xen folder.

     semanage fcontext -a -t xen_image_t "/virtualization(/.*)?"

     Alternatively, set the correct SELinux type for a KVM folder.

     semanage fcontext -a -t virt_image_t "/virtualization(/.*)?"


Is it worth swapping the Xen and KVM entries around, for first emphasis on KVM?

This looks like a carry over from RHEL 5 as well:

  http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Virtualization/sect-Virtualization-Security_for_virtualization-SELinux_considerations.html

  "The Boolean parameter xend_disable_t can set the xend to unconfined mode after restarting the daemon. It is better to disable protection for a single daemon than the whole system. It is advisable that you should not re-label directories as xen_image_t that you will use elsewhere."

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.