Restrict GPU and USB pass through to approved devices

OrtaDüzey 1Manuel incelemeopenshift-virt

Açıklama

The ability to pass through devices provides the capability to offload tasks from the CPU to the device itself. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

List the host devices available to virtualization workloads and verify the host devices returned are necessary for workload execution. $ oc get hyperconverged kubevirt - hyperconverged - n openshift - cnv -ojsonpath='{.spec.permittedHostDevices}'

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Enforcing limitations to the passthroughof approved devices protects against the introduction of a malicious or unknown device to the system. The system administrator can remove the unwanted devices by patching the HCO object. { "mediatedDevices": [ { "mdevNameSelector": "DEVICE_A", "resourceName": "vendor.com/DEVICE_A" } ], "pciHostDevices": [ { "externalResourceProvider": true, "pciDeviceSelector": "XXX:YYY", "resourceName": "vendor.com/DEVICE_B" }, { "pciDeviceSelector": "NNN:MMM", "resourceName": "vendor.com/DEVICE_C" } ], "usbHostDevices": [ { "resourceName": "kubevirt.io/storage", "selectors": [ { "product": "0001", "vendor": "46f4" } ] } ] If the first PCI device (the DEVICE_A at index 0, in bold) should not be permitted to be passed through to a VM, here’s how to remove it: $ oc ...

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: openshift-virtmanual-review
Referans: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.1 Restrict GPU and USB pass through to approved devices