On Wed, 28 Oct 2026 at 13:51, Fabiano Rosas <[email protected]> wrote: > > Peter Maydell <[email protected]> writes: > > Thanks. I think we could maybe make the text clearer. Here's my > > suggestion, that splits out the cases into a set of bullet points: > > > > * **migration/snapshots**. The user must deploy QEMU following the > > design principles described in the Architecture section to ensure > > that the migration stream is secure. Plain manipulation of the stream > > is not considered to be an attack vector. This means that: > > * Migration failures and snapshot load failures are part of normal > > operation; these are not bugs as long as the source virtual machine > > or savevm file are still functional > > * Aborts, crashes or misbehaviour of the destination QEMU due to > > an externally manipulated migration stream are bugs, but not > > security issues > > * A crash of the destination QEMU that can be triggered by a guest > > manipulating a device on the source QEMU before a migration may > > be a security issue, if it meets the other criteria we document > > for security issues > > > > How does that sound? > > > > Looks good, thanks. I'll send a patch.
Thanks. You should check whether I have the nested-bulleted list rst syntax correct there, I just hand-wrote it in the email client :-) > > I think we should also: > > > > * add a subsection to the "Sensitive configurations" part of this > > document at the bottom, that makes it clear that the user needs > > to be careful about the migration stream and loadvm files > > (to parallel the one that says "it's your job to lock down > > monitor access") > > * update the part at the to of the document that includes in > > its list of untrusted entities "Network protocols (e.g. NBD, > > live migration)" as this suggests the opposite of what the > > later text says. I guess just delete "live migration" ? > > > > Yes, this one has been coming up frequently. The point was to keep > developers thinking about migration stream validation. But it's > misleading, better to remove it. > > > We also have 15 or so existing bugs that are labelled "confidential" > > but which are "crafted migration stream can exploit the destination > > QEMU". Unless you object I'll mark all those as non-confidential > > non-security issues. > > > > Ack OK, I'll do that at some point this week. -- PMM
