Re: A few KVM security questions

[Avi Kivity <avi@redhat.com>]

On 12/07/2009 03:55 PM, Joanna Rutkowska wrote:
>
>> It should be fairly easy to place qemu in a guest.  You would leave a
>> simple program on the host to communicate with kvm and pass any data
>> written by the guest to qemu running in another guest, and feed any
>> replies back to the guest.
>>
>>      
> But then you would need to have another qemu (on the host) to support
> running this "qemu-VM", where we want to put the qemu, right?
>    

Right, but to exploit this, you'd have to exploit the internal qemu, 
exploit the kernel, and exploit the external qemu.  Well, if the exploit 
was in some central thing I guess there isn't much value in the nesting.

You could alternatively use Xenner to run Xen guests for your qemu.  
That emulates a lot less.  But AFAIK xenner is moving towards qemu as well.

-- 
error compiling committee.c: too many arguments to function