Restrict GPU and USB pass through to approved devices

MittelStufe 1Manuelle Prüfungopenshift-virt

Beschreibung

The ability to pass through devices provides the capability to offload tasks from the CPU to the device itself. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

List the host devices available to virtualization workloads and verify the host devices returned are necessary for workload execution. $ oc get hyperconverged kubevirt - hyperconverged - n openshift - cnv -ojsonpath='{.spec.permittedHostDevices}'

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Enforcing limitations to the passthroughof approved devices protects against the introduction of a malicious or unknown device to the system. The system administrator can remove the unwanted devices by patching the HCO object. { "mediatedDevices": [ { "mdevNameSelector": "DEVICE_A", "resourceName": "vendor.com/DEVICE_A" } ], "pciHostDevices": [ { "externalResourceProvider": true, "pciDeviceSelector": "XXX:YYY", "resourceName": "vendor.com/DEVICE_B" }, { "pciDeviceSelector": "NNN:MMM", "resourceName": "vendor.com/DEVICE_C" } ], "usbHostDevices": [ { "resourceName": "kubevirt.io/storage", "selectors": [ { "product": "0001", "vendor": "46f4" } ] } ] If the first PCI device (the DEVICE_A at index 0, in bold) should not be permitted to be passed through to a VM, here’s how to remove it: $ oc ...

Eigenschaften

Betriebssysteme: Beliebig
Tags: openshift-virtmanual-review
Referenz: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.1 Restrict GPU and USB pass through to approved devices