<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><font face="Calibri">I also happened to be looking at this today and was wondering about this as well. From the multi-places that talk about how to enable the qemu guest agent for quiescing drives during snapshots, they all have a warning that this should
be enabled on trusted guests only. [1] [2] [3] So, I am wondering has anyone actually solved any of the security issues called out in the tail end of [3]? It seems interesting that we would would make it so where the only flag that’s needed to enabled/disable
this is done on the image metadata – which any users that is given permission to upload images can set. Since this opens up a communication channel directly between the Untrusted (for most people running a cloud) vm and libvirt running on the HV.</font></div>
<div>
<div id="">
<div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri"><br>
</font></font></div>
<div><font face="Calibri">[1] - <span style="text-decoration: underline; text-indent: -151.2px;"><a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Virtualization_Deployment_and_Administration_Guide/chap-QEMU_Guest_Agent.html#idp9487712">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Virtualization_Deployment_and_Administration_Guide/chap-QEMU_Guest_Agent.html#idp948771</a>2</span><span style="text-indent: -151.2px;"> (see
the warning directly the title)</span></font></div>
<div><font face="Calibri"><font class="Apple-style-span" style="text-indent: -151.1999969482422px;">[2] - </font><span style="text-indent: -151.2px;"><a href="http://wiki.libvirt.org/page/Qemu_guest_agent">http://wiki.libvirt.org/page/Qemu_guest_agent</a> (see
the last sentence)</span></font></div>
<div><font face="Calibri">[3] - <a href="http://wiki.qemu.org/Features/QAPI/GuestAgent">http://wiki.qemu.org/Features/QAPI/GuestAgent</a> (See the Security section)</font></div>
<div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">___________________________________________________________________</font></font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Kris Lindgren</font></font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Senior Linux Systems Engineer</font></font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">GoDaddy</font></font></div>
</div>
</div>
</body>
</html>