How to harden KVM

[userapp3]

I am used to Virtualbox, however due to not being open source i’m setup now on KVM.

In virtualbox, I could go through the settings and turn off shared folders, turn off audio, etc. How can I do this, or confirm that this is all turned off in KVM?

thanks in advance, I hope to contribute to this project when my skills allow me to do so.

[Patrick]

Part of the steps but not a specific answer:

• https://www.whonix.org/wiki/KVM#XML_Modification_.28OPTIONAL.29
• https://www.whonix.org/wiki/KVM#Editing_an_imported_Machine.27s_XML_Configuration

The only hardening that I could find is:

• https://www.whonix.org/wiki/KVM#Disable_Microphone_Input

Someone else might now other hardening steps if any.

[HulaHoop]

How can I do this, or confirm that this is all turned off in KVM?

In the virt-manager GUI console go to :
View -> Details
The you’ll see all attached virtual devices in the left pane which you can strip out like Sound. We don;t have shared folders added by default (yet, though this will change with Whonix Host)

[HulaHoop]

The only hardening that I could find is:

• https://www.whonix.org/wiki/KVM#Disable_Microphone_Input

As soon as Buster is the new stable, we can now tweak the libvirt version on there to mute microphones fora VM while leaving speaker intact.

[Patrick]

disable speaker by default or optional for better security?

Continuing the discussion from How to harden KVM: Do we have to disable speaker as well? speakers could have two risks when VM is compromised: major: I have read somewhere that speakers can be abused to be used as a microphone too. lesser: exfiltration if devices nearby are in range. related: https://www.whonix.org/wiki/Hardware_Threat_Minimization#Microphones https://github.com/QubesOS/qubes-issues/issues/2724