Skip to navigationSkip to content
libvirtd docs
InteractiveCommands

Manual nav

Search `/` · tty `~` · g top · G bottom

Portal

  • Manual index
  • Interactive lab
  • Command explorer
Foundations5 sections
  • libvirtd Overview1
  • Host & Installation2
  • Architecture & Concepts6
  • Domains2
  • Domain XML2
Subsystems6 sections
  • Daemons3
  • virsh3
  • Virtual Networking5
  • Virtual Storage4
  • Virtualization Security3
  • Remote libvirt1
Operations5 sections
  • Migration2
  • Snapshots & Backup2
  • Performance3
  • Troubleshooting2
  • Reference2
LIBVIRT-SECURITY(7)03 entries

Virtualization Security

sVirt, SELinux/AppArmor, polkit, DAC ownership, secrets, TLS, and libvirt access-control boundaries.

  1. 01
    AppArmor and the sVirt isolation model

    AppArmor and SELinux solve a similar problem for libvirt: they confine the hypervisor and protect guest resources with mandatory access control. sVirt is the broader model that binds guest execution to labeled or profile

    man
  2. 02
    Libvirt access control and privilege boundaries

    Control of the system libvirt URI is close to root equivalent on many hosts. An authorized user can often define devices, attach host paths, alter networks, or influence privileged QEMU execution. Map the boundary Apply

    man
  3. 03
    SELinux, virtd_t, and common denials

    On SELinux enabled hosts, libvirt daemons run in controlled domains such as virtd t. Guest resources often carry svirt labels so the hypervisor can touch only what the policy allows. Why this breaks guest startup The gue

    man