[PATCH v2 1/3] docs: Mention security considerations for NBD

[Eric Blake <eblake@redhat.com>]

Document a policy that NBD connections should strongly consider using
TLS and x509 certificates to filter out untrusted clients.  If a
malicious server or client can trigger a QEMU assertion failure on a
plaintext connection, but can be trivially mitigated by enabling TLS
to weed out untrusted partners that would violate the protocol in the
first place, then I prefer to treat the bug as a lower-priority issue,
which our policy states can be fixed without an embargo.

Signed-off-by: Eric Blake <eblake@redhat.com>
---
 docs/system/security.rst | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docs/system/security.rst b/docs/system/security.rst
index e211fdd2344..7b422d51472 100644
--- a/docs/system/security.rst
+++ b/docs/system/security.rst
@@ -320,3 +320,24 @@ encryption and authorization control policy on client connections.
 In summary, the monitor console is considered a privileged control interface to
 QEMU and as such should only be made accessible to a trusted management
 application or user.
+
+Block device network protocols (NBD, NFS, etc.)
+'''''''''''''''''''''''''''''''''''''''''''''''
+
+When using QEMU to access remote storage over a network (such as QEMU
+acting as an NBD or NFS client) or to provide remote storage access
+(such as QEMU acting as an NBD server), it is important to realize
+that an unencrypted connection can allow an external process a
+potential attack vector over the network port. When possible, QEMU
+should be configured to require TLS to prevent a man-in-the-middle
+attack, as well as use x509 client certificates with the
+tls-creds-x509 object set with 'verify-peer=on' to check that the peer
+is allowed to connect. It may also be worth using 'tls-authz' to
+filter which certificates are allowed if the CA issues certs more
+broadly.
+
+Proper hardening of network connections can prevent the use of
+untrusted clients, and is therefore a factor when considering whether
+a malicious network partner that intentionally violates the
+communication protocol to trigger a QEMU bug can be treated as a lower
+priority bug.
-- 
2.56.0