NuKVM/virt-manager
3
0
Fork 0
mirror of https://github.com/virt-manager/virt-manager.git synced 2026-08-09 04:28:17 -05:00
Code Issues Packages Projects Releases Wiki Activity

domcapabilities: detect MDS new vulnerability

Browse Source 
There is a new security feature 'md-clear' that mitigates recent CPU
Microarchitectural Store Buffer Data vulnerability.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
This commit is contained in:
Pavel Hrdina
2019-05-14 20:11:39 +02:00
parent d8789a124f
commit c11d6ba4d7
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/virt-install.pod
+7 -6
View File
@@ -242,12 +242,13 @@ and 'disable=feature' respectively.
If exact CPU model is specified virt-install will automatically copy CPU
features available on the host to mitigate recent CPU speculative execution
side channel security vulnerabilities. This however will have some impact
on performance and will break migration to hosts without security patches.
In order to control this behavior there is a B<secure> parameter. Possible
values are I<on> and I<off>, with I<on> as the default. It is highly
recommended to leave this enabled and ensure all virtualization hosts have
fully up to date microcode, kernel & virtualization software installed.
side channel and Microarchitectural Store Buffer Data security vulnerabilities.
This however will have some impact on performance and will break migration
to hosts without security patches. In order to control this behavior there
is a B<secure> parameter. Possible values are I<on> and I<off>, with I<on>
as the default. It is highly recommended to leave this enabled and ensure all
virtualization hosts have fully up to date microcode, kernel & virtualization
software installed.
Some examples:
virtinst/domcapabilities.py
+2 -1
View File
@@ -281,7 +281,8 @@ class DomainCapabilities(XMLBuilder):
'spec-ctrl',
'ssbd',
'ibpb',
'virt-ssbd']
'virt-ssbd',
'md-clear']
if self._features:
return self._features