zlacker

[parent] [thread] 1 comments
1. bonzin+(OP)[view] [source] 2023-07-10 16:06:54
The main important point is that Libvirt takes care of privilege separation.

It makes sure that if your VM and/or QEMU are broken out of, there are extra layers to prevent getting access to the whole physical machine. For example it runs QEMU as a very limited user and, if you're using SELinux, the QEMU process can hardly read any file other than the vm image file.

By contrast the method in the arch wiki runs QEMU as root. QEMU is exposed to all sort of untrusted input, so you really don't want it to run as root.

Libvirt also handles cross machine operations such as live migration, and makes it easier to query a bunch of things from QEMU.

For more info see https://www.redhat.com/en/blog/all-you-need-know-about-kvm-u...

replies(1): >>zbroze+lU
2. zbroze+lU[view] [source] 2023-07-10 19:39:07
>>bonzin+(OP)
Thank you, this is the best explanation of the utility that I've seen. I appreciate it.
[go to top]