This might be another hint that I’m on the right track. @marmarek writes there: “… having SELinux enabled allows using it […] also for extra hardening of receiving side of qvm-copy.”