Isolating network resources in a virtualized environment

A system comprising:

• a memory device storing security context data and instructions;
• and
• a processor operatively coupled to the memory device, the processor executing the instructions to perform operations to:
• identify, by a hypervisor executed by a processor, access rights of a virtual machine to a network resource based on an entry in a security context data structure, wherein the entry comprises a first security context label and a plurality of access types, wherein the plurality of access types represent types of resource access for a virtual machine;
• validate, by the processor executing the hypervisor, access to the network resource by the virtual machine in view of the first security context label associated with the network resource and a second security context label associated with the virtual machine, wherein the first security context label and the second security context label corresponds to the entry in the security context data structure;
• access, by the processor executing the hypervisor, using I/O operations and a resource identifier of the network resource to access the network resource residing on a networked storage server, wherein the I/O operations bypasses access controls implemented by a host OS on the network resource of the network storage server once the host OS is authenticated;
• and
• authorize access to the network resource by the virtual machine in view of at least one of the plurality of access type associated with the entry in the security context data structure.

A non-transitory computer readable medium comprising executable instructions that when executed cause a processing device to perform operations comprising:

• identifying, using the processing device, access rights of a virtual machine to a network resource based on an entry in a security context data structure, wherein the entry comprises a first security context label, a resource identifier of the network resource, and a plurality of access types, wherein the plurality of access types represent types of resource access for the virtual machine;
• validating, by the processing device executing a hypervisor, access to the network resource by the virtual machine in view of the first security context label associated with the network resource and a second security context label associated with the virtual machine, wherein the first security context label and the second security context label corresponds to the entry in the security context data structure;
• accessing, by the hypervisor, using I/O operations and the resource identifier of the network resource to access the network resource residing on a networked storage server, wherein the I/O operations bypasses access controls implemented by a host OS on the network resource of the network storage server once the host OS is authenticated;
• and
• authorizing access to the network resource by the virtual machine in view of at least one of the plurality of access types associated with the entry in the security context data structure.