3 ms·

In a production system, it's highly unlikely that there is anything on the host besides the VM. You're not running qemu on one core and an unvirtualized databas

by geofft 7y ago

In a production system, it's highly unlikely that there is anything on the host besides the VM. You're not running qemu on one core and an unvirtualized database on another. Amazon is not running an S3 file server on the same physical machine that's being an EC2 host. The only valuable thing is other VMs. And I think that there is no common configuration of OpenStack or libvirt that assigns unique access control labels per VM. Every qemu runs with the same privileges, ergo one exploited qemu can laterally attack another. (But maybe there's something nifty I'm missing?) (Agree that for the use case of desktop virtualization, a good SELinux config can keep it from accessing your browser cookies.)

mjg59 7y ago
SVirt will usually use a per-VM label that should inhibit direct lateral interaction.
- bonzini 7y ago
  FWIW, sVirt is the "code name" for Libvirt's SELinux labeling scheme. It uses SELinux multi-category security to ensure that each QEMU can only access resources destined to one VM.