我如何用svirt保护hypervisor？

I'm working on project that aims to secure openstack, i want to secure virtualization, i’ve heard a lot about securing hypervisors so that I became afraid, what i understood that selinux does not require admin intervention since svirt generates automatic labels for instances and their disk image, so why there is to much debate about svirt and hypervisor security while putting selinux in mode enforcing is enough ??I'm working on project that aims to secure open