Walsh: Secure Virtualization Using SELinux (sVirt)

Security mechanisms need to be robust, but generally you can't expect them to protect themselves.

Grsec/pax folk are working on kernel heap hardening (KERNHEAP), which I hope we can get upstream in some form.

Protecting the kernel really needs hardware support, and features such as VT-d and TXT look promising here (although hardware can and does have bugs, too).