Hi,
How is it to transfer untrusted files to kicksecure guest using Xorriso compared to virtio9p and virtiofs.
Isn’t xorriso safer then virtio9p / virtiofs for host-to-guest file transfers?
1 Like
Depends on what you mean by “safer”. xorriso generates an ISO file, which has to be passed to the VM as a virtual optical disk. That requires adding a virtual optical disk drive to the VM, and undoing the cdrom driver blacklist in Kicksecure. This increases the attack surface in the VM, which could allow malware to elevate to root within the VM or in the worst case enable a VM escape. (Note that this is a theoretical risk, to my awareness there is no well-known way to abuse VirtualBox’s or QEMU’s cdrom emulation code or the cdrom driver(s) to do these things. These risks are why the cdrom drive is disabled and the driver is blacklisted by default.)
On the other hand, if you’re using a shared folder, the VM can attempt to exploit vulnerabilities in host-side software that automatically parses data in the shared folder. (Things like file manager thumbnailers, file indexers, and antivirus software can do this sort of thing.) There is also code in virtualizers and drivers in the Linux kernel to allow shared folders to work, so there are some of the same risks here as there are with virtual optical disks. This code is likely to be simpler than the code needed for virtual optical disks though, so it may pose less of a security risk.
If you’re using a security-conscious host OS like Kicksecure, I would consider folder sharing safer, since host-side file scanners aren’t provided in Kicksecure by design (and if any are discovered to be pulled in as a dependency, we should remove them). Otherwise, using ISOs might be better.
1 Like
Its about tranfering untrusted files from external hdd to disposable VM to execute there in case of malware and exploit .
I will follow this
I think my answer still applies in this instance. Both approaches have strengths and weaknesses, neither is perfect. You’ll potentially get less attack surface if you use a shared folder, but this depends on how the host is configured.
What you could do is transfer the files into the VM however you want to (shared folder, ISO, doesn’t matter that much), then shut down the VM, disable the file sharing mechanism you used (i.e. re-blacklist the cdrom driver, remove the virtual optical drive, or disable the shared folder, depending on how you did things), and then start the VM again. Then open the files. That way the attack surface from the file sharing mechanism isn’t available (or is at least reduced) when you open the files.
1 Like
Edited
PCI pass through and USB isolation is a different topic and would be better if posted in a new thread.
Edited