Walsh: Secure Virtualization Using SELinux (sVirt)

no, I would not expect to see someone trying to use AA to create generic seperation between virtual machines.

I could very easily see someone configuring AA to lock down a specific virtual machine to keep it from accessing things that another virtual machine is allowed to access. it would be based on the knowledge of what that particular virtual machine is supposed to access.

but since it's possible to run the virtual machines as seperate users, it would also be very easy to use the standard unix permissions to isolate them from each other, with probably 90% of the security for <<10% of the effort of using something like SELinux (and probably <50% of the effort of using AA)

with AA, if you have well defined applications (which I freely admit many/most people don't) it's relatively easy to create an AA profile for it. each AA profile is pretty much independent from other AA profiles, so if you just check them for overlapping you can combine them easily.

SELinux doesn't have tools (at least not well publicized tools) that let you do this. instead you have to understand the entire system (all local uses as well as all remotely accessible applications) and then make one big policy that defines all files correctly for all the applications (and you still have the problem of creating the appropriate tags for new files that are created), it's not something that your normal sysadmin can do. it's very hard for even extremely experienced security people to do (and it doesn't help that the common response to problems is "you don't know enough to be tinkering there, just use what your distro provides you with")

SELinux is more powerful than AA, no question, but it's complexity (and interactions in it's config) make it hard enough to use that most people don't bother (and if you think that the distro default configs are appropriate, I disagree with you, they are far too open because the sitros can't possibly know what's appropriate for a particular installation)

AA is far less powerful, but (if it was available in the default kernel) far more likely to be used.

I am not an AA user, because (having been burned a few times), I make it a policy to not use features that aren't in the kernel.org kernel unless I _absolutely_ have to, and so far my need for additional local security have not been that high yet.