[Qemu-devel] chroot jailing...

[address@hidden]

Would there be any security benefits, without suffering any considerable
relative loss in performance, to (chroot) jailing qemu? Can it,
practically speaking, be done?? Would that be a partial safeguard
against virtual machine escapes? Or is it the case that if a virtual
machine escape takes place, then all bets are probably off? (i.e., you
probably have already pole-vaulted over any filesystem driver/partition
access control mechanisms...) Are there any articles or discussions that
I can be directed to about it? (my focus for now is 64 bit, Intel core
i7...) Are there specific suggestions and/or guidelines for attempting
to do so -or not??