Re: [Qemu-devel] chroot jailing...

[Stefan Hajnoczi]

On Sun, Jan 12, 2014 at 02:17:43PM -0500, address@hidden wrote:
> Would there be any security benefits, without suffering any considerable
> relative loss in performance, to (chroot) jailing qemu? Can it,
> practically speaking, be done?? Would that be a partial safeguard
> against virtual machine escapes? Or is it the case that if a virtual
> machine escape takes place, then all bets are probably off? (i.e., you
> probably have already pole-vaulted over any filesystem driver/partition
> access control mechanisms...) Are there any articles or discussions that
> I can be directed to about it? (my focus for now is 64 bit, Intel core
> i7...) Are there specific suggestions and/or guidelines for attempting
> to do so -or not??

Isolating QEMU can be useful to prevent exposing data on the host or
from other guests.

Production systems using libvirt often run QEMU unprivileged and use
SELinux to restrict what resources the process has access to.  This way
a QEMU process that has been taken over still cannot get access to much
besides the files it already has open, the network device it uses, etc.

Stefan