Virtual machines must limit PCI/PCIe device passthrough functionality

СредњаНиво 1Аутоматскаvmware

Опис

DirectPath I/O features provide virtual machines the ability to directly access system hardware, which while advantageous for performance, can impact risk mitigation tools like vMotion, DRS, and High Availability. It also opens up a potential attack vector for privileged hardware access. Expected: no pciPassthruN.present = "TRUE". The audit parses every .vmx file under /vmfs/volumes/ on the host and lists the VMs that do not comply; it passes when none are found (or no VMs exist). Runs in the ESXi Shell (busybox sh) as root.

Како се проверава

Метод провере: Команда љуске

shell

command -v find >/dev/null 2>&1 || exit 1
out=$(find /vmfs/volumes/ -maxdepth 3 -type f -name '*.vmx' 2>/dev/null | while IFS= read -r f; do
  awk -v KEYRE='^pcipassthru[0-9]+[.]present$' -v MODE='not' -v VAL='TRUE' 'BEGIN { re = tolower(KEYRE) }
{ line = $0; sub(/^[ \t]+/, "", line); i = index(line, "="); if (i == 0) next
  k = tolower(substr(line, 1, i - 1)); sub(/[ \t]+$/, "", k)
  v = substr(line, i + 1); sub(/^[ \t]*"?/, "", v); sub(/"?[ \t\r]*$/, "", v); v = tolower(v)
  if (k ~ re) { seen = 1; if (MODE == "not" && v == tolower(VAL)) bad = bad " " k "=" v
                else if (MODE != "not" && MODE != "ge" && v != tolower(VAL)) bad = bad " " k "=" v
                else if (MODE == "ge" && (v + 0) < (VAL + 0)) bad = bad " " k "=" v } }
END { if ((MODE == "eq" || MODE == "ge") && !seen) bad = " " KEYRE " not set"
      if (bad != "") print FILENAME ":" bad }' "$f"
done)
[ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 25

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

The following PowerCLI command can be used: # Add the setting to all VMs Get-VM | New-AdvancedSetting -Name "pciPassthru*.present" -value "false"

Својства

Оперативни системи: Било који
Ознаке: vmwareesxivirtual-machine
Референца: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 7.7 Virtual machines must limit PCI/PCIe device passthrough functionality

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target vmware