Walsh: Secure Virtualization Using SELinux (sVirt)

Indeed, Linux is the hypervisor in this case (kvm/qemu), although I'm personally more comfortable with a large well-tested codebase than a small, obscure one.

There is a project to separate Xen domains with MAC: XSM/Flask, which applies the Flask architecture to the Xen hypervisor and separates drivers into their own domains and also allows for runtime verification of guest kernels.