| Message ID | 20230510202654.225689-6-iii@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | gdbstub: Add support for info proc mappings | expand |
Ilya Leoshkevich <iii@linux.ibm.com> writes: > Now that the GDB stub implements reading host files, concerns may arise > that it undermines security. Document the status quo, which is that the > users are already responsible for securing the GDB connection > themselves. > > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Hi, Just to add two cents here: the commit message is a bit not true because the qemu-user GDB stub could always read host files by just changing the emulated code to open and read those files. Apart from that, I like the documentation additions. Best regards, Dominik 'Disconnect3d' Czarnota On Wed, 24 May 2023 at 12:27, Alex Bennée <alex.bennee@linaro.org> wrote: > > Ilya Leoshkevich <iii@linux.ibm.com> writes: > > > Now that the GDB stub implements reading host files, concerns may arise > > that it undermines security. Document the status quo, which is that the > > users are already responsible for securing the GDB connection > > themselves. > > > > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> > > Reviewed-by: Alex Bennée <alex.bennee@linaro.org> > > -- > Alex Bennée > Virtualisation Tech Lead @ Linaro >
diff --git a/docs/system/gdb.rst b/docs/system/gdb.rst index 453eb73f6c4..3cc5167d928 100644 --- a/docs/system/gdb.rst +++ b/docs/system/gdb.rst @@ -192,3 +192,18 @@ The memory mode can be checked by sending the following command: ``maintenance packet Qqemu.PhyMemMode:0`` This will change it back to normal memory mode. + +Security considerations +======================= + +Connecting to the GDB socket allows running arbitrary code inside the guest; +in case of the TCG emulation, which is not considered a security boundary, this +also means running arbitrary code on the host. Additionally, when debugging +qemu-user, it allows directly downloading any file readable by QEMU from the +host. + +The GDB socket is not protected by authentication, authorization or encryption. +It is therefore a responsibility of the user to make sure that only authorized +clients can connect to it, e.g., by using a unix socket with proper +permissions, or by opening a TCP socket only on interfaces that are not +reachable by potential attackers.
Now that the GDB stub implements reading host files, concerns may arise that it undermines security. Document the status quo, which is that the users are already responsible for securing the GDB connection themselves. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> --- docs/system/gdb.rst | 15 +++++++++++++++ 1 file changed, 15 insertions(+)