Rootless virtual machines with KVM and QEMU

[nurmagoz]

@trustme-arch

I did not check for Whonix VM to VM traffic leaks

If you mean by leaks its unencrypted and can be viewed by the host, then yes it is check:

Encrypting or Securing VM-VM communications

This is something sadly not being focused on from any hypervisor that i know to do that by default/design. Thats mean any local app can sniff the connection/s and even manipulate them. What we can do about it is either: Restricted file permission We can make the connection isolated via unix socket file e.g file location /tmp/whonix-network.sock and we restrict this file. and in GW: -netdev socket,id=net0,unix=/tmp/whonix.sock,server=on in WS: -netdev socket,id=net0,unix=/tmp/whonix.sock…