docs: Add security considerations for migration
Add the security considerations that are unique to migration and that do not already fall into one of the other categories. Some aspects are better framed as security architecture considerations, so extend that section to mention TLS and clarify that disk images and guest network also need to be isolated from other processes, not just other guests. Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/r/20260721131457.3062767-1-farosas@suse.de Signed-off-by: Peter Xu <peterx@redhat.com>
Fabiano Rosas committed
Jul 21, 2026 at 10:14 UTC
8b6405a493a2106eaa3893237595afb4759ca498
1 file changed
+18
-4
docs/system/security.rst
+18
-4
@@ -133,6 +133,16 @@ an issue as a normal bug.
133
that affect the level 0 QEMU process. While these bugs should be
134
fixed, they will not be triaged as security flaws at this time.
135
136
+* **migration/snapshots**. Migration failures and snapshot load
137
+ failures are considered part of normal operation as long as the
138
+ source virtual machine and savevm file, respectively, are still
139
+ functional. Aborting the QEMU process at the migration/snapshot
140
+ destination is similarly not considered a security issue. The
141
+ migration stream is assumed to be secure as long as the design
142
+ principles described in the Architecture section are held, in
143
+ which case plain manipulation of the stream is not considered as
144
+ an attack vector.
145
+
146
* **low severity impact**. As a catch all rule, issues which
147
are judged to have a "low" severity impact on the system will
148
usually not justify handling as security bugs, nor assignment
@@ -159,10 +169,11 @@ could allow malicious guests to gain code execution in QEMU. At this point the
169
guest has escaped the virtual machine and is able to act in the context of the
170
QEMU process on the host.
171
162
-Guests often interact with other guests and share resources with them. A
163
-malicious guest must not gain control of other guests or access their data.
164
-Disk image files and network traffic must be protected from other guests unless
165
-explicitly shared between them by the user.
172
+Guests often interact with other guests and share resources with them.
173
+A malicious guest must not gain control of other guests or access
174
+their data. Disk image files and network traffic must be protected
175
+from other guests, users and processes unless explicitly shared with
176
+them by the user.
177
178
Principle of Least Privilege
179
''''''''''''''''''''''''''''
@@ -223,6 +234,9 @@ Some Linux distros already ship with UNIX groups for these devices by default.
234
system calls that are not needed by QEMU, thereby reducing the host kernel
235
attack surface.
236
237
+- Transport Layer Security (TLS) protocol can be used to ensure authenticity and
238
+ encryption of the live migration connection where the network is untrusted.
239
+
240
Sensitive configurations
241
------------------------
242