QEMU Guest Agent nur bestimmte Befehle erlauben
Der QEMU Guest Agent ist die Schnittstelle zwischen dem Hypervisor und QEMU / KVM VMs.
Referenz: https://qemu-project.gitlab.io/qemu/interop/qemu-ga-ref.html
Dinge wie guest-shutdown oder guest-fsfreeze-freeze sind sicher sinnvoll, andere Dinge wie guest-ssh-add-authorized-keys oder guest-set-user-password sind etwas, von dem ein Hoster die Finger lassen sollte. Wird ein vertrauenswürdiger Anbieter auch sicher so machen, aber Kontrolle ist besser.
Also besser die möglichen Kommandos entsprechend einschränken:
/etc/systemd/system/qemu-guest-agent.service.d/override.conf erstellen/anpassen:
[Service]
ExecStart=
ExecStart=/usr/sbin/qemu-ga --blacklist=guest-set-time,guest-file-open,guest-file-close,guest-file-read,guest-file-write,guest-file-seek,guest-file-flush,guest-get-fsinfo,guest-set-user-password,guest-get-memory-blocks,guest-set-memory-blocks,guest-exec-status,guest-exec,guest-get-users,guest-get-osinfo,guest-get-devices,guest-ssh-get-authorized-keys,guest-ssh-add-authorized-keys,guest-ssh-remove-authorized-keys
# List all commands:
# qemu-ga --blacklist=?
#
# List of commands as of v7.2.13 (2024-10-04)
# (commands prefixed with X are blacklisted above)
#
# guest-sync-delimited
# guest-sync
# guest-ping
# guest-get-time
# X guest-set-time
# guest-info
# guest-shutdown
# X guest-file-open
# X guest-file-close
# X guest-file-read
# X guest-file-write
# X guest-file-seek
# X guest-file-flush
# guest-fsfreeze-status
# guest-fsfreeze-freeze
# guest-fsfreeze-freeze-list
# guest-fsfreeze-thaw
# guest-fstrim
# guest-suspend-disk
# guest-suspend-ram
# guest-suspend-hybrid
# guest-network-get-interfaces
# guest-get-vcpus
# guest-set-vcpus
# guest-get-disks
# X guest-get-fsinfo
# X guest-set-user-password
# X guest-get-memory-blocks
# X guest-set-memory-blocks
# guest-get-memory-block-info
# X guest-exec-status
# X guest-exec
# guest-get-host-name
# X guest-get-users
# guest-get-timezone
# X guest-get-osinfo
# X guest-get-devices
# X guest-ssh-get-authorized-keys
# X guest-ssh-add-authorized-keys
# X guest-ssh-remove-authorized-keys
# guest-get-diskstats
# guest-get-cpustatsDanach die Kiste neustarten oder:
systemctl daemon-reload
systemctl restart qemu-guest-agent