In this lesson, you will learn how to enforce workload isolation in multi-tenant cloud environments by applying mandatory security labels that span both the hypervisor and the guest operating system.
When multiple tenants share the same physical hardware, the primary security risk is a "breakout" where one tenant accesses the memory or processes of another. To mitigate this, we rely on Mandatory Access Control (MAC) systems like SELinux or AppArmor, which use security contexts—often referred to as labels—to define exactly what a process can and cannot touch.
Hypervisor-Level Labeling
At the hypervisor level, you must ensure that each virtual machine (VM) image or container instance is assigned a unique security label. For example, using sVirt (Secure Virtualization), the hypervisor automatically labels the process hosting the VM with a unique category. This prevents the hypervisor process from accessing files belonging to other VMs, even if a guest kernel is compromised. You can verify this by checking the process attributes:
ps -efZ | grep qemu
# Example output:
# system_u:system_r:svirt_t:s0:c123,c456 qemu-kvm ...
The s0:c123,c456 represents the specific security category for that tenant.
Guest-Level Labeling
Inside the guest, you must extend this isolation by applying strict MAC policies that restrict which services can communicate or access local files. Since the guest kernel is unaware of the hypervisor's categories, you enforce internal policies using domain transitions. By labeling tenant-specific applications with distinct domains (e.g., tenant_a_t and tenant_b_t), you ensure that even if one application in a tenant’s suite is compromised, it cannot move laterally into the memory space or data directories assigned to a different tenant’s domain.
This dual-layer approach creates a "defense-in-depth" strategy: the hypervisor labels prevent unauthorized access to host resources, while guest labels ensure granular process-to-resource isolation within the tenant's own environment. Always ensure that your security labels are non-overlapping to prevent accidental policy leakage across tenant boundaries.
Key Takeaway: Effective multi-tenant isolation requires consistent security labeling at both the hypervisor layer to guard shared resources and the guest layer to prevent lateral movement between processes.