OpenStack for Architects - Second Edition

sVirt

sVirt is a solution that adds effective separation to virtualized environments using Mandatory Access Control (MAC) with implementations such as SELinux and AppArmor. This hardens systems against bugs in the hypervisor that could be used as an attack vector toward the hypervisor host or another instance running on the same hypervisor. SELinux uses a pluggable framework using MAC and allows guests and their resources to have unique labels. Once all of the instances, as well as the host, are labeled, rules can be created to allow or reject access across instances.

When using sVirt, the process works properly in the background, invisible to the instances themselves. Each instance's processes are labeled with a dynamically created label ...