LinuxCon + ContainerCon North America 2016

The QEMU projects provides the foundation for the overwhelming majority of open source virtualization deployments, being used for both KVM and Xen. This large deployment footprint makes QEMU an attractive target for exploitation and its wide variety of features offer many avenues for attack, whether from the guest or from other infrastructure on the managment LAN. The presentation will outline the technologies available that should be used in all deployments to protect QEMU and its communication channels from compromise. This will cover confinement of the QEMU process, security of its network services, security of its disk storage and future gaps in protection that remain to be addressed.