This could help: https://people.redhat.com/duffy/selinux/selinux-coloring-boo...

>It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need.

That is not too hard to imagine. Basically, the rationale is that if qemu/libvirt can read your ROM file, it can probably read other files too, some of which might be sensitive. So the defaults are conservative. Unless your rom file is in a standard location where it expects, it won't read even if the permissions are 644.

>So after scratching my head, I just turned it off altogether

selinux is annoying, but it is worth persisting. Nowadays, most things work well. I think things are bit more stable in RHEL/CentOS than Fedora by definition. So maybe you can try that if you are getting too many selinux related problems.

However in my experience so far, the defaults do not get in your way during regular usage. You typically only encounter such issues when you're also in the position to fix them. And I think in general it's a great idea to have default deny policies for containers and VMs.

> So after scratching my head, I just turned it off altogether.

Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com.

For example, It can control whether an application can bind to a privileged network port (below 1024) or whether an app can write to areas other than its default working directory.

And it is not immediately obvious when it's causing issues, just because it's not used as strictly or at all in other distros. I was having trouble connecting to a service I started in Fedora, even though I disabled firewalld. Turns out it was SELinux.

`getsebool -a` and `setsebool` are your friends.