On Tue, Jul 14, 2020 at 02:06:30PM +0530, P J P wrote: > From: Prasad J Pandit <p...@fedoraproject.org> > > Hello, > > QEMU supports numerous virtualisation and emulation use cases. > It offers many features to support guest's function(s). > > All of these use cases and features are not always security relevant. > Because some maybe used in trusted environments only. Some may still > be in experimental stage. While other could be very old and not > used or maintained actively. > > Recently we received multiple security issue reports against VVFAT > and VirtFS host directory sharing system. After discussing with the > respective maintainers, it turned out that > > * VVFAT -> https://bugs.launchpad.net/qemu/+bug/1883083 > VVFAT is quite old and is available for testing purposes only. > Ie. It is not suitable for production environments. > > * VirtFS/9pfs -> https://wiki.qemu.org/Documentation/9psetup > VirtFS implementation though better, it is most commonly used for > automated testing under sand-boxed server environments, ie. no > malicious party there. It is also not mature enough for cloud services. > It is supported on 'Odd Fixes' basis atm. > > So these turned out to be issues which can be fixed as regular bugs. > > For security bug analysis we generally consider use cases wherein > QEMU is used in conjunction with the KVM hypervisor, which enables > guest to use hardware processor's virtualisation features. > > This patch introduces the CVE (or Security or Trust) Quotient field > in the MAINTAINERS file. It tries to capture the security sensitivity > pertaining to a feature or section of the QEMU's code base. > > It indicates whether a potential issue should be treated as a security > one OR it could be fixed as a regular non-security bug. > > If Quotient == High, triage issues as potential security ones. > if Quotient == Low, triage issues as regular non-security bugs. > > I have tagged each section in the MAINTAINERS file as High or Low on best > guess basis. I request respective maintainers to kindly review it please. > > If you have any inputs/suggestions, I'd really appreciate them. > > Thank you.
So this attempts to specify a security aspect of specific files. Which works for some use-cases (e.g. devices) but not others (common utility functions). I'd like to propose add a flag that limits QEMU to a secured subset of functionality at runtime instead. Then we can just tell security researchers "reproduce this with -security=high or it's not a security issue". > -- > Prasad J Pandit (1): > MAINTAINERS: introduce cve or security quotient field > > MAINTAINERS | 324 ++++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 324 insertions(+) > > -- > 2.26.2
