Its not about this anymore, its about changing the game entirely, no root policy thats first thing. Second is securing the user side and VMs from other applications, well we have already missing things:
- passt apparmor which can be copied from ubuntu and modified.
- Apparmor per VM or one for all of the VMs.
- Securing VMs connections mentioned here.
By implementing these we have the best OS for KVM VMs, as vbox and xen (most likely proxmox as well) dont have these security features together.