)]}'
{"specs/ocata/approved/clear-memory-after-deleting-vm.rst":[{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"9be140f0ae8142567bd95a92f766567baa7a227d","unresolved":false,"context_lines":[{"line_number":128,"context_line":"References"},{"line_number":129,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"None"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"History"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa7ab95a_ef9a1461","line":131,"range":{"start_line":131,"start_character":0,"end_line":131,"end_character":4},"updated":"2016-08-30 21:27:39.000000000","message":"I\u0027d recommend adding a reference to this section, such as http://docs.openstack.org/security-guide/tenant-data/data-privacy-concerns.html#instance-memory-scrubbing","commit_id":"adc0d5d14ca7993cb9fc9a139ad7ca5403f4dbc7"},{"author":{"_account_id":17288,"name":"liuxiuli","email":"liu.lixiu@zte.com.cn","username":"liu-lixiu"},"change_message_id":"3161d9f2fc180803739a1b6d59f96a282d382cba","unresolved":false,"context_lines":[{"line_number":128,"context_line":"References"},{"line_number":129,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"None"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"History"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa7ab95a_bac67047","line":131,"range":{"start_line":131,"start_character":0,"end_line":131,"end_character":4},"in_reply_to":"fa7ab95a_ef9a1461","updated":"2016-08-31 10:06:55.000000000","message":"OK. Thanks！","commit_id":"adc0d5d14ca7993cb9fc9a139ad7ca5403f4dbc7"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"d4c1f693e6153997a4db7504f079cf9746a7985f","unresolved":false,"context_lines":[{"line_number":27,"context_line":"      \u003cmemoryclear/\u003e"},{"line_number":28,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Add memoryclear in libvirt.xml when boot VM when hw:memoryclear in"},{"line_number":31,"context_line":"flavor or hw_memoryclear in image is set to True."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a89bdaa_7e8f3bcc","line":30,"range":{"start_line":30,"start_character":19,"end_line":30,"end_character":26},"updated":"2016-09-06 09:38:09.000000000","message":"I think you target to libvirt, maybe add libvirt: before your title ? or do you plan to support other hypervisors?","commit_id":"fc63fc1ac50b36e319ae4ec4b2ac0ae43a7c07d6"},{"author":{"_account_id":17288,"name":"liuxiuli","email":"liu.lixiu@zte.com.cn","username":"liu-lixiu"},"change_message_id":"a30251bdcf2652abe652721461a2cbbffd50d263","unresolved":false,"context_lines":[{"line_number":27,"context_line":"      \u003cmemoryclear/\u003e"},{"line_number":28,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Add memoryclear in libvirt.xml when boot VM when hw:memoryclear in"},{"line_number":31,"context_line":"flavor or hw_memoryclear in image is set to True."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a89bdaa_25baec0a","line":30,"range":{"start_line":30,"start_character":19,"end_line":30,"end_character":26},"in_reply_to":"9a89bdaa_7e8f3bcc","updated":"2016-09-12 10:43:37.000000000","message":"Done","commit_id":"fc63fc1ac50b36e319ae4ec4b2ac0ae43a7c07d6"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"4319cae049cf5339a670b112c5bee7d4b2719b65","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"We can analyze content of memory used by vm if memory is not cleared after"},{"line_number":21,"context_line":"deleting vm, this will cause a safety problem."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"By default, the memory clear feature is disable in qemu, we need to add"},{"line_number":24,"context_line":"memoryclear in order to enabled memory clear, like this::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a89bdaa_d9776539","line":21,"updated":"2016-09-12 11:41:41.000000000","message":"To be able to analyse memory of a VM after it has shutdown requires that the attacker have a root login on the virtualization host, in order to be able to access /dev/mem to read physical memory pages directly. If they have such privileges, then they can also just read the guest memory while it is running. IOW clearing RAM after a guest shuts down does not provide you any security benefit.\n\nTo protect against malicious host admin reading guest memory fundamentally requires hardware extensions, such as the recently announced AMD secure memory encryption feature. If you have that feature, then there is no need to clear memory, as you\u0027ll not have the keys needed to decrypt the memory of the shutdown VM.\n\nIOW, this spec does not appear to provide any useful improvement to nova security.","commit_id":"f8b4497b609160110bff809a37652b06cfbc2c9a"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"92c0a8cd81cd628bc65e2e534d814ccd7b731eb6","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    \u003cmemoryBacking\u003e"},{"line_number":27,"context_line":"      \u003cmemoryclear/\u003e"},{"line_number":28,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Add memoryclear in libvirt.xml when boot VM when hw:memoryclear in"},{"line_number":31,"context_line":"flavor or hw_memoryclear in image is set to True."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a89bdaa_ab7fab64","line":28,"updated":"2016-09-12 11:14:12.000000000","message":"Where is this flag coming from ? There is no such flag in either libvirt or QEMU upstream codebase.","commit_id":"f8b4497b609160110bff809a37652b06cfbc2c9a"}]}