Provmox VE 8.0 and Apparmor for VM

[jlbbb]

Hello,

As the title states I would like more info about the state of Apparmor profiles for Proxmox Virtual Machines, is it possible to confine VMs with Apparmor? Does Proxmox offer any facility to do so? Just running one with default settings doesn't seem to get it confined, am I wrong?

As a bonus question: if the answer is no, is there a way to run VIRTIO ONLY machines? So that the use of QEMU virtualized devices is at its lowest?

Thank you!

 

[LnxBil]

As the title states I would like more info about the state of Apparmor profiles for Proxmox Virtual Machines, is it possible to confine VMs with Apparmor? Does Proxmox offer any facility to do so? Just running one with default settings doesn't seem to get it confined, am I wrong?

Sounds interesting, yet I don't know what you want to confine here. Do you have any information about how it should/could work?

As a bonus question: if the answer is no, is there a way to run VIRTIO ONLY machines? So that the use of QEMU virtualized devices is at its lowest?

that depends on the guest OS, but yes, it should be possible. CPU, harddisk, network, mouse, keyboard all virtualized.

 

[jlbbb]

Sounds interesting, yet I don't know what you want to confine here. Do you have any information about how it should/could work?

Hello there!

I would like to confine the QEMU processes, Libvirt seems to do it, you can read more about Libvirt's way here: https://libvirt.org/drvqemu.html#apparmor-svirt-confinement

That makes it possible to contain the QEMU processes when a vulnerability is found (and exploited) in parts of them (mostly the fully virtualized devices, I see...)

Does it make QEMU more secure? Maybe.
Is that a panacea? Perhaps not.
Does it break anything? Not that I'm aware of if the profile is generated dynamically.
Would it be nice to have? Most probably I believe...


Now, since I mentioned it, you may well be replying "go with Libvirt then", well... I'd rather not...!

that depends on the guest OS, but yes, it should be possible. CPU, harddisk, network, mouse, keyboard all virtualized.

Or... paravirtualized! That's what I wanted, less QEMU emulation more VirtIO.

 

[LnxBil]

I would like to confine the QEMU processes, Libvirt seems to do it, you can read more about Libvirt's way here: https://libvirt.org/drvqemu.html#apparmor-svirt-confinement

Thank you for the information. Looks good. Maybe create a feature request in order to get "more attention" from the Proxmox staff.