Understanding SELinux MCS Separation

Securely running virtual machines on a host requires separation between the processes running the VMs (as well as the storage and other assets they manage). To achieve this separation, the Secure Virtualization (sVirt) feature of Red Hat Enterprise Linux relies on Multi Category Security (MCS) features of SELinux.

We designed a new way of using MCS when we developed sVirt a few years ag...