)]}'
{"security-guide/section_hardening-the-virtualization-layers.xml":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"d27dabe08a4b3b8d0f885c3ee288ea9869a52d95","unresolved":false,"context_lines":[{"line_number":213,"context_line":"        \u003c/para\u003e"},{"line_number":214,"context_line":"        \u003cprogramlisting\u003eCFLAGS\u003d\"-arch x86_64 -fstack-protector-all -Wstack-protector \\"},{"line_number":215,"context_line":" --param ssp-buffer-size\u003d4 -pie -fPIE -ftrapv -D_FORTIFY_SOURCE\u003d2 -O2 \\"},{"line_number":216,"context_line":" -Wl,-z,relro,-z,now\"\u003c/programlisting\u003e"},{"line_number":217,"context_line":"        \u003cpara\u003e"},{"line_number":218,"context_line":"          We recommend testing your QEMU executable file after it is"},{"line_number":219,"context_line":"          compiled to ensure that the compiler hardening worked"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_80a3e5af","line":216,"updated":"2014-08-11 08:15:17.000000000","message":"Do we have some reference links here? Why are thos compiler options are recommend?","commit_id":"e03feb4e72a8804b8fb1cb8475a596e122eaa2a0"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f4bfecae1bf56d0317a3f4e68f26beac349a38eb","unresolved":false,"context_lines":[{"line_number":213,"context_line":"        \u003c/para\u003e"},{"line_number":214,"context_line":"        \u003cprogramlisting\u003eCFLAGS\u003d\"-arch x86_64 -fstack-protector-all -Wstack-protector \\"},{"line_number":215,"context_line":" --param ssp-buffer-size\u003d4 -pie -fPIE -ftrapv -D_FORTIFY_SOURCE\u003d2 -O2 \\"},{"line_number":216,"context_line":" -Wl,-z,relro,-z,now\"\u003c/programlisting\u003e"},{"line_number":217,"context_line":"        \u003cpara\u003e"},{"line_number":218,"context_line":"          We recommend testing your QEMU executable file after it is"},{"line_number":219,"context_line":"          compiled to ensure that the compiler hardening worked"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_333fca87","line":216,"in_reply_to":"baada198_80a3e5af","updated":"2014-08-11 11:33:51.000000000","message":"Those flags come from the recommendations above - but I agree, it could be clearier that the RELRO flags are \"-Wl,-z,relro,-z,now\" etc.","commit_id":"e03feb4e72a8804b8fb1cb8475a596e122eaa2a0"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"d27dabe08a4b3b8d0f885c3ee288ea9869a52d95","unresolved":false,"context_lines":[{"line_number":217,"context_line":"        \u003cpara\u003e"},{"line_number":218,"context_line":"          We recommend testing your QEMU executable file after it is"},{"line_number":219,"context_line":"          compiled to ensure that the compiler hardening worked"},{"line_number":220,"context_line":"          properly.\u003c/para\u003e"},{"line_number":221,"context_line":"        \u003cpara\u003e"},{"line_number":222,"context_line":"          Most cloud deployments will not want to build software such"},{"line_number":223,"context_line":"          as QEMU by hand. It is better to use packaging to ensure"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_206f7962","line":220,"updated":"2014-08-11 08:15:17.000000000","message":"Do we have some more details here? How to test the QEMU executable?","commit_id":"e03feb4e72a8804b8fb1cb8475a596e122eaa2a0"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"d27dabe08a4b3b8d0f885c3ee288ea9869a52d95","unresolved":false,"context_lines":[{"line_number":242,"context_line":"          like to limit the impact of the attack. Mandatory access"},{"line_number":243,"context_line":"          controls accomplish this by restricting the privileges on"},{"line_number":244,"context_line":"          QEMU process to only what is needed. This can be"},{"line_number":245,"context_line":"          accomplished using sVirt / SELinux or AppArmor. When using"},{"line_number":246,"context_line":"          sVirt, SELinux is configured to run each QEMU process under"},{"line_number":247,"context_line":"          a separate security context. AppArmor can be configured to"},{"line_number":248,"context_line":"          provide similar functionality. We provide more details on"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_a0a9c979","line":245,"updated":"2014-08-11 08:15:17.000000000","message":"I\u0027m really missing https://grsecurity.net/ here.","commit_id":"e03feb4e72a8804b8fb1cb8475a596e122eaa2a0"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"d27dabe08a4b3b8d0f885c3ee288ea9869a52d95","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          controls accomplish this by restricting the privileges on"},{"line_number":244,"context_line":"          QEMU process to only what is needed. This can be"},{"line_number":245,"context_line":"          accomplished using sVirt / SELinux or AppArmor. When using"},{"line_number":246,"context_line":"          sVirt, SELinux is configured to run each QEMU process under"},{"line_number":247,"context_line":"          a separate security context. AppArmor can be configured to"},{"line_number":248,"context_line":"          provide similar functionality. We provide more details on"},{"line_number":249,"context_line":"          sVirt in the instance isolation section below.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_e03bc136","line":246,"updated":"2014-08-11 08:15:17.000000000","message":"sVirt is a part of Libvirt today (https://www.redhat.com/archives/libvir-list/2009-March/msg00092.html) and I think it is not necessary to mention sVirt. Instead we should talk about the seclabels in Libvirt. It\u0027s also a little bit misleading because sVirt has an different context in the next section.","commit_id":"e03feb4e72a8804b8fb1cb8475a596e122eaa2a0"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"d27dabe08a4b3b8d0f885c3ee288ea9869a52d95","unresolved":false,"context_lines":[{"line_number":246,"context_line":"          sVirt, SELinux is configured to run each QEMU process under"},{"line_number":247,"context_line":"          a separate security context. AppArmor can be configured to"},{"line_number":248,"context_line":"          provide similar functionality. We provide more details on"},{"line_number":249,"context_line":"          sVirt in the instance isolation section below.\u003c/para\u003e"},{"line_number":250,"context_line":"      \u003c/section\u003e"},{"line_number":251,"context_line":"    \u003c/section\u003e"},{"line_number":252,"context_line":"    \u003csection xml:id\u003d\"hardening-the-virtualization-layers-idp510512\"\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_c0aebd7f","line":249,"updated":"2014-08-11 08:15:17.000000000","message":"Can we add a link to the \"instance isolation section\" here?","commit_id":"e03feb4e72a8804b8fb1cb8475a596e122eaa2a0"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f4bfecae1bf56d0317a3f4e68f26beac349a38eb","unresolved":false,"context_lines":[{"line_number":246,"context_line":"          sVirt, SELinux is configured to run each QEMU process under"},{"line_number":247,"context_line":"          a separate security context. AppArmor can be configured to"},{"line_number":248,"context_line":"          provide similar functionality. We provide more details on"},{"line_number":249,"context_line":"          sVirt in the instance isolation section below.\u003c/para\u003e"},{"line_number":250,"context_line":"      \u003c/section\u003e"},{"line_number":251,"context_line":"    \u003c/section\u003e"},{"line_number":252,"context_line":"    \u003csection xml:id\u003d\"hardening-the-virtualization-layers-idp510512\"\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_3356eacd","line":249,"in_reply_to":"baada198_c0aebd7f","updated":"2014-08-11 11:33:51.000000000","message":"This is just the next section. But let me rephrase it.","commit_id":"e03feb4e72a8804b8fb1cb8475a596e122eaa2a0"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"77b7d5c2af4da16a6fa58cdcb06ce439e6589cde","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        attacks.\u003c/para\u003e"},{"line_number":112,"context_line":"      \u003cpara\u003e"},{"line_number":113,"context_line":"        Therefore, it is important to take proactive steps to harden"},{"line_number":114,"context_line":"        QEMU. Three specific steps are recommended: minimizing the"},{"line_number":115,"context_line":"        code base, using compiler hardening, and using mandatory"},{"line_number":116,"context_line":"        access controls such as sVirt, SELinux, or AppArmor."},{"line_number":117,"context_line":"      \u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"baada198_bd8d4e2c","line":114,"updated":"2014-08-12 00:37:11.000000000","message":"This is changing it from active to passive voice.  Would active voice be preferred per https://wiki.openstack.org/wiki/Documentation/Conventions#Use_active_voice?","commit_id":"01cf314f838e15719790eb873f221273c1da880d"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"227ef2ba8f91efb019ddb34e7a55b9769d184b04","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        attacks.\u003c/para\u003e"},{"line_number":112,"context_line":"      \u003cpara\u003e"},{"line_number":113,"context_line":"        Therefore, it is important to take proactive steps to harden"},{"line_number":114,"context_line":"        QEMU. Three specific steps are recommended: minimizing the"},{"line_number":115,"context_line":"        code base, using compiler hardening, and using mandatory"},{"line_number":116,"context_line":"        access controls such as sVirt, SELinux, or AppArmor."},{"line_number":117,"context_line":"      \u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"baada198_f56fd690","line":114,"in_reply_to":"baada198_bd8d4e2c","updated":"2014-08-12 05:21:57.000000000","message":"Active voice is preferred - but \"We\" is not preferred either. ;(","commit_id":"01cf314f838e15719790eb873f221273c1da880d"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"77b7d5c2af4da16a6fa58cdcb06ce439e6589cde","unresolved":false,"context_lines":[{"line_number":274,"context_line":"          \u003cterm\u003eHypervisor threats\u003c/term\u003e"},{"line_number":275,"context_line":"          \u003clistitem\u003e"},{"line_number":276,"context_line":"            \u003cpara\u003e"},{"line_number":277,"context_line":"              When a compromised application running within a virtual"},{"line_number":278,"context_line":"              machine attacks the hypervisor to access underlying"},{"line_number":279,"context_line":"              resources. For example, when a virtual machine is able"},{"line_number":280,"context_line":"              to access the hypervisor OS, physical devices, or other"}],"source_content_type":"application/xml","patch_set":4,"id":"baada198_bddb8e1f","line":277,"updated":"2014-08-12 00:37:11.000000000","message":"This now lacks parallelism with the entry below.  Perhaps we should decide on a preferred approach and use it throughout?","commit_id":"01cf314f838e15719790eb873f221273c1da880d"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"227ef2ba8f91efb019ddb34e7a55b9769d184b04","unresolved":false,"context_lines":[{"line_number":274,"context_line":"          \u003cterm\u003eHypervisor threats\u003c/term\u003e"},{"line_number":275,"context_line":"          \u003clistitem\u003e"},{"line_number":276,"context_line":"            \u003cpara\u003e"},{"line_number":277,"context_line":"              When a compromised application running within a virtual"},{"line_number":278,"context_line":"              machine attacks the hypervisor to access underlying"},{"line_number":279,"context_line":"              resources. For example, when a virtual machine is able"},{"line_number":280,"context_line":"              to access the hypervisor OS, physical devices, or other"}],"source_content_type":"application/xml","patch_set":4,"id":"baada198_b509dedd","line":277,"in_reply_to":"baada198_bddb8e1f","updated":"2014-08-12 05:21:57.000000000","message":"conventions are always good ;) Do you have a suggestion? Let me make those parallel again...","commit_id":"01cf314f838e15719790eb873f221273c1da880d"}]}