Walsh: Secure Virtualization Using SELinux (sVirt)

NFS really sucks in this respect and there's no real satisfactory answer, since SELinux requires xattr labelling support on FS. So you won't get the sVirt per-guest disk image isolation on NFS at this time, only block device, local filesystems, or more advanced network FS' like GFS which can do xattr.