It doesn't even make sense to think about permissions for unikernels. There is exactly one application running. The trust boundary is at the edge of this application/kernel/VM thing, not anywhere within it.