-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 2016-11-26 14:29, Grzesiek Chodzicki wrote: > W dniu sobota, 26 listopada 2016 19:52:39 UTC+1 użytkownik Pawel Debski > napisał: >> W dniu sobota, 26 listopada 2016 18:56:49 UTC+1 użytkownik Grzesiek >> Chodzicki napisał: >>> put following command in dom0 terminal: qvm-prefs -s vmname pci_strictreset >>> false >> >> Tx Greg, that works. >> >> Can we briefly discuss how much does it lower the security of the >> workstation. I mean: does it really allow to plug-in fabricated USB device >> to install keylogger to obtain credentials to highly sensitive applications >> running in other qube (say VaultVM). >> >> What other potential attack scenaria does it open? >> (assuming that one is interested only to protect VaultVM transient content) > > If the device is assigned to one vm only at all times then it doesn't lower > security afaik. PCI strict reset is used to reset the device's state when > moving the device between machines. If the device is not moved between > machines then it shouldn't matter. >
Correct. From `man qvm-prefs`: pci_strictreset Accepted values: True, False Control whether prevent assigning to VM a device which does not support any reset method. Generally such devices should not be assigned to any VM, because there will be no way to reset device state after VM shutdown, so the device could attack next VM to which it will be assigned. But in some cases it could make sense - for example when the VM to which it is assigned is trusted one, or is running all the time. - -- Andrew David Wong (Axon) Community Manager, Qubes OS https://www.qubes-os.org -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYO4QdAAoJENtN07w5UDAwDQUP/j8ipg43tTTftByJ57Fgwoee 3jt4EQtOu/Dj9B1zOvJjdESSXFBconqzRuB6gtEXkUJFNbHVM1zXrYKVl3BIs8fL 9Q5bde7bFOL3s8iUct9LUptZrkJApWE1lLslIXkf310Q/ZueWOeDOj6AWH3JgOQq 4e+YRfmWo2iYdgtOwE8lTafhf6dWW70XwaigDgftmjSrEEXQzCDZIB/skxJYFk08 FTvO/j9Hf5yfjRVHMWCXkK7XNAWQGcZfVh0CXv/mW8YEfmw/c+C9bJMT5HYjf6xw SuLMX5plaE1uqUhGrNhKLICfrF+mr6D0fJLbUqblGmRY7TyneyT4KY404T6euMQw nfgyrXQXhEPk9IDDXI+Lhf1rEOFiSIqovTxMbTdj6nYlvhE4tuj951sOvcsbwXje sriPw1viRntTOLXig41tj1cuKCtoAzoUCz1E/EDS4lUAMJ9eh85sxyGevBxbDMnl H3nE1pyTmy0sobvIc8MwdcgMdQM18yCxmoFq3GbHp3gnibngRSufMbNBe7/u0XKK ihTQxY1hUMnhq/iiXg1UwLVUqDY/1ohzvB0gs3qqvh7AT6gu+8ypEhkxydpv04bb ZcqWZO1C+z9xmDz0k2rHL9nViqj2D/C1PgWJ1/y3MFR+S84TVnOEWt0QjvhOYgSH +Hse/mswOmQy9h+BNNpf =6i/C -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/848eb69d-92bf-1af1-b771-cf385b04d0a2%40qubes-os.org. For more options, visit https://groups.google.com/d/optout.
