On: QEMU VM Escape

[bonzini]

Unfortunately all shared library entry points have to be marked as possible destinations for indirect jumps. However, both seccomp and SELinux can block the execve system call.