Restrict GPU and USB pass through to approved devices

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

List the host devices available to virtualization workloads and verify the host devices returned are necessary for workload execution. $ oc get hyperconverged kubevirt - hyperconverged - n openshift - cnv -ojsonpath='{.spec.permittedHostDevices}'

修正方法

修正方法: ガイダンスまたは IaC パッチ

Enforcing limitations to the passthroughof approved devices protects against the introduction of a malicious or unknown device to the system. The system administrator can remove the unwanted devices by patching the HCO object. { "mediatedDevices": [ { "mdevNameSelector": "DEVICE_A", "resourceName": "vendor.com/DEVICE_A" } ], "pciHostDevices": [ { "externalResourceProvider": true, "pciDeviceSelector": "XXX:YYY", "resourceName": "vendor.com/DEVICE_B" }, { "pciDeviceSelector": "NNN:MMM", "resourceName": "vendor.com/DEVICE_C" } ], "usbHostDevices": [ { "resourceName": "kubevirt.io/storage", "selectors": [ { "product": "0001", "vendor": "46f4" } ] } ] If the first PCI device (the DEVICE_A at index 0, in bold) should not be permitted to be passed through to a VM, here’s how to remove it: $ oc ...