In-Guest Mechanism to Strengthen Guest Separation
summary
Shows a concrete architecture that confines each QEMU instance to its own SELinux label so VM qemu processes and their tap/block devices cannot read other guests’ disks, implemented in XenClient XT by assigning unique SELinux MCS categories per qemu and per device. Uses a small interposed binary between the toolstack and qemu (code on GitHub) rather than heavy stubdoms; this reduces attack surface and works for disk isolation. Explores extending the same idea into xsm/Zenstore for multi‑tenant IVC with Zen store negotiation and clearer policy semantics.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:19Background
- 2:38User-space mechanisms
- 5:06Caution
- 8:23Diagrams & Conventions
- 12:59sVirt Details
- 15:34sVirt Analysis / Code
- 16:18Multi-Tennant Orchestration
- 17:17Multi-tenant Orchestration
- 21:10Inter-VM Communication
- 22:17IVC policy model
- 27:45Policy Semantics
related talks
41mSecuring Your Xen-Based Cloud
32mQubes OS: Security Through Isolation
10mBring SCSI Support Into QEMU Block Layer
19mRethinking Isolation Mechanisms for Datacenter Multitenancy
31mSecure IO
38mUnmapped Private Memory for Confidential Guests
50mPanel Discussion: KVM-based Virtualization Contributor Q&A
18mGuest Memory Protection -- Current Status and Future