Abstract: Provided are systems and methods for applying access controls to separate and contain virtual machines in a flexible, configurable manner. Access can be granted or removed to a variety of system resources—including network cards, shared folders, and external devices. Operations, such as cut and paste, between the virtual machines can be restricted or allowed. Virtual machines are run in containers. This allows more than one virtual machine to share the same access profile. Containers can be configured to allow a user to instantiate a virtual machine at run time. This allows the user to dynamically define which virtual machines run in various containers. An administrator determines which containers (if any) allow dynamic instantiation, and specifies the list of virtual machines the user can choose from. A container, and/or virtual machines within the container, can be restricted to particular users.

Abstract: Presented herein are systems and methods for configuring a mandatory access control security policy in a computer, and applications thereof. An embodiment provides a security configuration program. The security configuration program configures a security policy based on user input. For example, a user may provide input regarding ranges of values corresponding to a resource, such as ports and/or Internet protocol (IP) addresses, to which a process is to be granted access. The security configuration program configures the security policy to allow the process access to the specified ranges of values for the resource. In this way, a security configuration program in accordance with an embodiment of the present invention allows a user to configure and extend a security policy without special knowledge of the security policy language.