Walsh: Secure Virtualization Using SELinux (sVirt)

by the way, I don't choose to use SELinux due to the complexity, but I do use commercial firewalls that use similar security systems, and my opinion of them is poor, due to the demand of users the real security of the system has been scaled back to the point that there is really almost nothing that can be done without being the equivalent of 'root', so the first command anyone ever types is makes them this root equivalent. this just about destroys the value of having separate users, let alone the MAC tagging and controls. the firewall vendor used to have several different roles, each with different permissions, but users of these expensive commercial firewalls were unhappy with that so the vendor scaled back the evvective security.