Skip to content

feat: toggles to reduce attack surface #1722

@alexhaydock

Description

@alexhaydock

I confirm this feature has not been previously requested

  • [ x ] I have searched the issues and this feature has not previously been requested

Is your feature request related to a problem? Please describe.
Quickemu as a project aims to "do the right thing" when setting up VMs so they "just work".

This is definitely a valuable goal, but it's such a good software project that it's useful for many use-cases, including situations where a VM is being used to test less-trusted software inside a guest.

In these situations it would be nice to be able to reduce some of the automatically-enabled features of guest VMs with simple boolean toggles in the config file.

Describe the solution you'd like
From what I can tell, the following features are added automatically to the QEMU commandline executed behind the scenes and are not easily toggleable to be "off":

  • USB/SPICE redirection (regardless of whether USB passthrough is actually being used)
  • USB CCID / Smartcard passthrough (regardless of whether the user actually needs one)
  • Folder sharing between host and guest with 9p
  • SSH forwarding

In my view, it ought to be reasonably easy to implement a boolean toggle for these options in the config file. Something along the lines of:

usb_redir="false"
usb_ccid="false"
folder_sharing="false"
ssh_fwd="false"

To maintain the "it just works" approach of Quickemu I think the best approach would be to retain the default-on mode of these features, and just document the boolean off toggles for them in the Advanced Features section of the Wiki.

Describe alternatives you've considered
N/A

This approach seems sensible and is not a breaking change as Quickemu will continue to work exactly as before for users who do not enable the above options in their config files.

Additional context
N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions