It seems that from this forum post that the guest can get information about the host’s hardware such as your CPU. I’ve also tested this on Virtualbox and the CPU is shown.
Would it make sense to restrict /proc/cpuinfo, lspci and some files in /sys to root?
Has anyone tested whether other hardware information is leaked? Like motherboards, network adapters, GPUs etc.
Virtualbox doesn’t leak the motherboard information. I haven’t tested this on other hypervisors.
Certain hardware devices like audio controllers and SATA controllers can be found by running lspci. Virtualbox spoofs this info. I haven’t tested this on other hypervisors either.
This (change of default file permissions) should be reported as a bug or feature request upstream too (even if they don’t implement it - we benefit from their comments, perhaps would otherwise miss a good argument to not do this).
You suggested to hide from everyone but root, ok. (Edited)
Related, which was an attempt to hide hardware information even from root:
I meant to hide from everyone but root. It wouldn’t have anything to do with the actual hypervisors themselves but to do with the permissions on certain files. Hiding it from root as well would be good but it doesn’t seem possible on certain hypervisors so hiding it from regular users would be the next best thing.
I am not sure sound quite feature request alike / request for change of defaults alike. Let’s see what they say.
Alternatively, subject:
prevent non-root users from viewing hardware information from /proc/cpuinfo, /bin/lspci and /sys
text:
possibility of this being an identifier
Not sure they care. Can we make this a security argument? Principle of least privilege? What’s the use case for non-root users to view hardware information?
Hardware information may be useful for an attacker to know what exploits in some firmware to use.
They could probably detect the firmware by seeing what modules are loaded though.
If your adversary is one with lots of resources then knowing the hardware may help in utilizing potential hardware backdoors. A bit extreme but seems possible.
At the moment I pass thru all CPU flags from the host to the guest to allow the guest kernel spectre/meltdown protections to kick in. Restricting this info to root is a great step.
Also preventing unprivileged processes from enumerating info from /proc/pid does make it harder for rowhammer attacks:
Grsecurity had a feature that restricted access to /sys to root only. This would help hide most hardware information from ordinary users except information in /proc.
