[Qemu-devel] QEMU - Security Research Questions

[Qemu-devel] QEMU - Security Research Questions

[Joey Connelly]

Hey QEMU dev group,
I'm a graduate student at Boise State University working on my thesis
involving Virtualization/Cloud Computing Security and I wanted to ask a few
questions:

*[QUESTION#1.]* From within a guest KVM/QEMU process (qemu-system-x86_64
-enable-kvm) can the VM invoke commands on its host - either through QEMU
Monitor Console commands, or by some other means I'm unaware of?

*[QUESTION#**2.]* Can a host administrator running a guest KVM/QEMU process
have QEMU Monitor Console commands invoked on that guest VM if *no*
"-monitor" option was used?

*[QUESTION#**3.]* If a host admin creates a KVM/QEMU process with the
"qemu-system-x86_64 -enable-kvm -netdev tap,<...>" options is there a
KVM/QEMU specific way to query the "tap,<...>" information later after the
process has been created? (assuming your admin account maintains ring 0
permissions)

Thanks for your time,
-Joey

Re: [Qemu-devel] QEMU - Security Research Questions

[Paolo Bonzini]

On 06/10/2016 02:10, Joey Connelly wrote:
> Hey QEMU dev group,
> I'm a graduate student at Boise State University working on my thesis
> involving Virtualization/Cloud Computing Security and I wanted to ask a few
> questions:
> 
> *[QUESTION#1.]* From within a guest KVM/QEMU process (qemu-system-x86_64
> -enable-kvm) can the VM invoke commands on its host - either through QEMU
> Monitor Console commands, or by some other means I'm unaware of?
> 
> *[QUESTION#**2.]* Can a host administrator running a guest KVM/QEMU process
> have QEMU Monitor Console commands invoked on that guest VM if *no*
> "-monitor" option was used?
> 
> *[QUESTION#**3.]* If a host admin creates a KVM/QEMU process with the
> "qemu-system-x86_64 -enable-kvm -netdev tap,<...>" options is there a
> KVM/QEMU specific way to query the "tap,<...>" information later after the
> process has been created? (assuming your admin account maintains ring 0
> permissions)

No to all three.

Paolo

Re: [Qemu-devel] QEMU - Security Research Questions

[Markus Armbruster]

Paolo Bonzini <pbonzini@redhat.com> writes:

> On 06/10/2016 02:10, Joey Connelly wrote:
>> Hey QEMU dev group,
>> I'm a graduate student at Boise State University working on my thesis
>> involving Virtualization/Cloud Computing Security and I wanted to ask a few
>> questions:
>> 
>> *[QUESTION#1.]* From within a guest KVM/QEMU process (qemu-system-x86_64
>> -enable-kvm) can the VM invoke commands on its host - either through QEMU
>> Monitor Console commands, or by some other means I'm unaware of?
>> 
>> *[QUESTION#**2.]* Can a host administrator running a guest KVM/QEMU process
>> have QEMU Monitor Console commands invoked on that guest VM if *no*
>> "-monitor" option was used?
>>
>> *[QUESTION#**3.]* If a host admin creates a KVM/QEMU process with the
>> "qemu-system-x86_64 -enable-kvm -netdev tap,<...>" options is there a
>> KVM/QEMU specific way to query the "tap,<...>" information later after the
>> process has been created? (assuming your admin account maintains ring 0
>> permissions)
>
> No to all three.

The pedantically correct answer to #2 would be "not easily": you'd have
to play games with a debugger.

Re: [Qemu-devel] QEMU - Security Research Questions

[Eric Blake]

[-- Attachment #1: Type: text/plain, Size: 2130 bytes --]

On 10/06/2016 03:27 AM, Markus Armbruster wrote:
> Paolo Bonzini <pbonzini@redhat.com> writes:
> 
>> On 06/10/2016 02:10, Joey Connelly wrote:
>>> Hey QEMU dev group,
>>> I'm a graduate student at Boise State University working on my thesis
>>> involving Virtualization/Cloud Computing Security and I wanted to ask a few
>>> questions:
>>>
>>> *[QUESTION#1.]* From within a guest KVM/QEMU process (qemu-system-x86_64
>>> -enable-kvm) can the VM invoke commands on its host - either through QEMU
>>> Monitor Console commands, or by some other means I'm unaware of?
>>>
>>> *[QUESTION#**2.]* Can a host administrator running a guest KVM/QEMU process
>>> have QEMU Monitor Console commands invoked on that guest VM if *no*
>>> "-monitor" option was used?
>>>
>>> *[QUESTION#**3.]* If a host admin creates a KVM/QEMU process with the
>>> "qemu-system-x86_64 -enable-kvm -netdev tap,<...>" options is there a
>>> KVM/QEMU specific way to query the "tap,<...>" information later after the
>>> process has been created? (assuming your admin account maintains ring 0
>>> permissions)
>>
>> No to all three.
> 
> The pedantically correct answer to #2 would be "not easily": you'd have
> to play games with a debugger.

In which case, the pedantically correct answer to #1 is "if there is,
then that's a CVE and please tell us so we can plug it".  You can track
recent qemu CVEs to see where we have been fixing such issues as they
get reported.

Note also that a host can choose whether to rely on the guest (for
example, that's what qga is all about); and it is feasible that you
could use qga or a similar channel where a host and guest can cooperate
such that the host will act on behalf of a guest request - but that such
interaction is up to the host to permit, and should only be permitted
for trusted guests.  A guest by itself should never be able to drive
host behavior without host permission first, and a host should never
rely on qga or other channels to an untrusted guest.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 604 bytes --]

Re: [Qemu-devel] QEMU - Security Research Questions

[Kevin Wolf]

Am 06.10.2016 um 10:27 hat Markus Armbruster geschrieben:
> Paolo Bonzini <pbonzini@redhat.com> writes:
> 
> > On 06/10/2016 02:10, Joey Connelly wrote:
> >> Hey QEMU dev group,
> >> I'm a graduate student at Boise State University working on my thesis
> >> involving Virtualization/Cloud Computing Security and I wanted to ask a few
> >> questions:
> >> 
> >> *[QUESTION#1.]* From within a guest KVM/QEMU process (qemu-system-x86_64
> >> -enable-kvm) can the VM invoke commands on its host - either through QEMU
> >> Monitor Console commands, or by some other means I'm unaware of?
> >> 
> >> *[QUESTION#**2.]* Can a host administrator running a guest KVM/QEMU process
> >> have QEMU Monitor Console commands invoked on that guest VM if *no*
> >> "-monitor" option was used?
> >>
> >> *[QUESTION#**3.]* If a host admin creates a KVM/QEMU process with the
> >> "qemu-system-x86_64 -enable-kvm -netdev tap,<...>" options is there a
> >> KVM/QEMU specific way to query the "tap,<...>" information later after the
> >> process has been created? (assuming your admin account maintains ring 0
> >> permissions)
> >
> > No to all three.
> 
> The pedantically correct answer to #2 would be "not easily": you'd have
> to play games with a debugger.

I think it's rather "it depends". If you don't actively disable it, the
default (i.e. running qemu-system-x86_64 without any parameters) gives
you an HMP monitor. You can use things like '-monitor none' or
'-nodefaults' to get rid of it.

By the way, Gerd, just 'qemu-system-x86_64 -nodefaults' gives me a GTK
window that contains only the menu bar and almost all options in the
"View" menu make it segfault.

Kevin