docs/system/security.rst

5 --------
11 ---------------------
24 safely on the physical CPU at close-to-native speed.
29 - Guest
30 - User-facing interfaces (e.g. VNC, SPICE, WebSocket)
31 - Network protocols (e.g. NBD, live migration)
32 - User-supplied files (e.g. disk images, kernels, device trees)
33 - Passthrough devices (e.g. PCI, USB)
36 real-world use cases and treated as security bugs if this is the case.
38 Non-virtualization Use Case
41 The non-virtualization use case covers emulation using the Tiny Code Generator
43 the non-virtualization use case should meet the same security requirements as
45 non-virtualization use case code was not written with these security
48 Bugs affecting the non-virtualization use case are not considered security
49 bugs at this time.  Users with non-virtualization use cases must not rely on
53 ------------
92 ``a.img`` and not guest B's disk image file ``b.img``.
101 clearly documented so users are aware of the trade-off of enabling the feature.
109 launch QEMU, such as libvirt.  They are also platform-specific so they are only
117 It is also possible to launch QEMU as a non-root user and configure UNIX groups
121 - SELinux and AppArmor make it possible to confine processes beyond the
126 - Resource limits and cgroup controllers provide throughput and utilization
129 - Linux namespaces can be used to make process, file system, and other system
133 - Linux seccomp is available via the QEMU ``--sandbox`` option.  It disables
138 ------------------------
153 ``blockdev-add`` command instructs QEMU to open arbitrary files, exposing
163 perform man-in-the-middle attacks. Many of the character device backends do not