> Now, let's say this VM has a function for opening a file in the local
> filesystem. It outsources permissions checking to the host system; any
> file which the user launching the VM could read or write, the VM could
> also.

If your vm allows opening arbitary special files you already lost.

Alan