On Tue, 21 Jul 2026 at 14:15, Fabiano Rosas <[email protected]> wrote:
>
> Add the security considerations that are unique to migration and that
> do not already fall into one of the other categories. Some aspects are
> better framed as security architecture considerations, so extend that
> section to mention TLS and clarify that disk images and guest network
> also need to be isolated from other processes, not just other guests.
>
> Reviewed-by: Peter Xu <[email protected]>
> Reviewed-by: Daniel P. Berrangé <[email protected]>
> Signed-off-by: Fabiano Rosas <[email protected]>
> ---
> docs/system/security.rst | 22 ++++++++++++++++++----
> 1 file changed, 18 insertions(+), 4 deletions(-)
>
> diff --git a/docs/system/security.rst b/docs/system/security.rst
> index 52bbf0cc7a2..af626a42307 100644
> --- a/docs/system/security.rst
> +++ b/docs/system/security.rst
> @@ -133,6 +133,16 @@ an issue as a normal bug.
> that affect the level 0 QEMU process. While these bugs should be
> fixed, they will not be triaged as security flaws at this time.
>
> +* **migration/snapshots**. Migration failures and snapshot load
> + failures are considered part of normal operation as long as the
> + source virtual machine and savevm file, respectively, are still
> + functional. Aborting the QEMU process at the migration/snapshot
> + destination is similarly not considered a security issue. The
> + migration stream is assumed to be secure as long as the design
> + principles described in the Architecture section are held, in
> + which case plain manipulation of the stream is not considered as
> + an attack vector.
Reading this (which is now in our docs), it seems unclear to me
about whether it intends to say that any and all bugs that can
be triggered only by manipulating the migration stream are outside
the security scope, or only some of them.
It says "plain manipulation of the stream is not considered as
an attack vector", which suggests "everything is out of scope".
But on the other hand it has an explicit list ("migration
failures", "snapshot load failures", "aborting the QEMU process"),
so does it mean by that that other things than those listed
(e.g. "overruns a buffer in the destination") still are security
issues ?
I'd appreciate clarification, as it would make it easier to
triage reported issues out of the confidential state.
thanks
-- PMM
