>assume that code execution on your Linux systems equates to privesc
Tell this to the container community. They would have you believe containers are as secure as VMs.
Tell this to the container community. They would have you believe containers are as secure as VMs.
Chances are what you want is "simply" access to a shared folder rather than root.
1. Most users won't be affected by all the exploits (you don't stuff in a VM all models of network cards, SCSI controllers, etc)
2. Many deployments of QEMU (through Xen or Libvirt) are protected by AppArmor/SELinux. This would at least forbid access to /proc/self/mem but I can't say if this is enough to prevent evasion. IMO, this is likely to make the task quite harder.
That's certainly a goal, but I've never heard the claim.
This article is very hopeful and positively worded, but at its core it acknowledges that security parity is still a work in progress.