[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] security: the qemu agent command "guest-exec" may cause Insider Access

On Fri, Aug 25, 2017 at 06:45:18AM +0000, Zhangbo (Oscar) wrote:
Hi all:
    The Host Administrator is capable of running any exec in guests via the qemu-ga command "guest-exec", eg:

       virsh qemu-agent-command test_guest '{"execute": "guest-exec", "arguments": {"path": "ifconfig", "arg": [ "eth1", "" ],"capture-output": true } }'
      virsh qemu-agent-command test_guest '{"execute": "guest-exec-status", "arguments": { "pid": 12425 } }'

     The example above just change the guests' ip address, the Administrator may also change guests' user password, get sensitive information, etc. which causes Insider Access.
     The Administrator also can use other commands such as " guest-file-open" that also cause Insider Access.

     So, how to avoid this security problem, what's your suggestion?

What's your setup that this, in particular, is your concern?  Do you
have everything encrypted by keys that are not reachable for the host
administrator?  How are those saved?  For example, how do you guard
against the host administrator killing the domain?  Or mounting the disk
of the domain, doing whatever they want to with it and starting it back?
Or million other things that come to mind.  Not trusting the host
administrator is kinda (well, precisely) like not trusting root on *NIX


P.S.: Maybe more aluminium could help, but I haven't tried yet.

Best Regrads

libvir-list mailing list
libvir-list redhat com

Attachment: signature.asc
Description: Digital signature

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]