22 ms·
Proper vm isolation with selinux is better than either separately. What if you get a QEMU VM break out.
by ungamed 9y ago
Proper vm isolation with selinux is better than either separately. What if you get a QEMU VM break out.
- AstralStorm 9y agoSELinux is quite possible and easy to disable with any local root kernel exploit. They only thing it might make harder is actual act of exploitation by shutting down syscalls and sensitive parts of file system. Compared to these, VM are rare. You typically need one of those to attempt breakout anyway. Then again, three were a plenty exploits against general FS or common calls like poll... Things you cannot limit in this way because they are used by apps in question.