Signed-off-by: Alex Jia <ajia(a)redhat.com&gt; --- bin/virt-sandbox.c | 17 +++++++++++++---- 1 files changed, 13 insertions(+), 4 deletions(-) diff --git a/bin/virt-sandbox.c b/bin/virt-sandbox.c index 69d1e62..bd7ac49 100644 --- a/bin/virt-sandbox.c +++ b/bin/virt-sandbox.c @@ -372,13 +372,22 @@ separated by commas. The following options are valid for SELinux =over 4 -=item type=TYPE +=item dynamic -The SELinux security type, defaults to sandbox_t +Dynamically allocate an SELinux label, using the default base context. +The default base context is system_u:system_r:svirt_lxc_net_t:s0 for LXC, +system_u:system_r:svirt_t:s0 for KVM, system_u:system_r:svirt_tcg_t:s0 +for QEMU. -=item level=LEVEL +=item dynamic,label=USER:ROLE:TYPE:LEVEL -The SELinux MCS level, defaults to a randomly allocated level +Dynamically allocate an SELinux label, using the base context +USER:ROLE:TYPE:LEVEL, instead of the default base context. + +=item static,label=USER:ROLE:TYPE:LEVEL + +To set a completely static label. For example, +static,label=system_u:system_r:svirt_t:s0:c412,c355 =back -- 1.7.1