There have been at least a few kernel privesc vulnerabilities, for example, which have apparently been mitigated successfully with SELinux (I assume that the SE

There have been at least a few kernel privesc vulnerabilities, for example, which have apparently been mitigated successfully with SELinux (I assume that the SELinux policies prevent the necessary pre-conditions of the exploit being met, like denying certain ioctls etc. before they can do damage). I guess it depends on the nature of the exploit. In any case it sounds like libvirtd can automatically assign a unique category to each VM guest's resources in a way which inhibits guest-to-guest interactions by default.