KVM, QEMU, and kernel project management
KVM, QEMU, and kernel project management
Posted Mar 30, 2010 19:57 UTC (Tue) by nix (subscriber, #2304)In reply to: KVM, QEMU, and kernel project management by jeremiah
Parent article: KVM, QEMU, and kernel project management
Sure it can. But the host can observe the guest's RAM, so can easily
acquire any necessary encryption keys and do the decryption itself. Even
if it got the key off the network, the host could spy on the network and
capture the key, or spy on the guest and watch the key come in, and then
capture it.
acquire any necessary encryption keys and do the decryption itself. Even
if it got the key off the network, the host could spy on the network and
capture the key, or spy on the guest and watch the key come in, and then
capture it.
It is simply not possible to protect a VM guest from root on its host. The
host controls *everything*.