Restrict pass through of GPUs and Host devices to the Virtual Machine

보통레벨 1수동 검토openshift-virt

설명

The ability to pass through certain devices like a GPU or NVMe can improve performance by offloading certain tasks from the CPU to the device itself, but it also introduces shared system resources and additional attack vectors for bad actors. Configuring GPUs or host devices for the virtual machine can put the guest at risk. It's important to be selective and only enable passthrough for devices that are critical to the operation of your workloads. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Use the following command to list gpus associated with a virtual machine: $ oc get vm -A -ojson | jq '.items[] | select(.spec.template.spec.domain.devices.gpus | length > 0) | {vm_name: .metadata.name, namespace: .metadata.namespace, gpus: .spec.template.spec.domain.devices.gpus}' Use the following command to list hostDevices associated with a virtual machine: $ oc get vm -A -ojson | jq '.items[].spec.template.spec.domain.devices.hostDevices' This check applies to any created VMs. Results of this query will be in this form: [ { "deviceName": "<resource - name>", "name": "<device - name>" }, { "deviceName": "<resource - name>", "name": "<device - name>" } ]

조치 방법

조치 방식: 가이드 또는 인프라 패치

Only enable approved devices which are trust - worthy and strictly necessary by the workload. For example, if the first host device above (index 0, in bold) should not be permitted to be passed through to a given VM, here’s how to remove it: $ oc patch vm <vm-name> --type='json' -p='[ {"op": "remove", "path": "/spec/template/spec/domain/devices/hostDevices/0"}, ]'

속성

운영 체제: 모두
태그: openshift-virtmanual-review
참고 자료: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 2.1 Restrict pass through of GPUs and Host devices to the Virtual Machine