Chapter 19. Securing virtual machines

Procedure

1. Enable TPM 2.0 by adding the following parameters to the <devices> section in the VM’s XML configuration.

   <devices>
   [...]
     <tpm model='tpm-crb'>
       <backend type='emulator' version='2.0'/>
     </tpm>
   [...]
   </devices>

2. Install the Windows guest operating system in UEFI mode.
3. Install the VirtIO drivers on the Windows VM. For more information about how to do so, see Installing virtio drivers on a Windows guest.
4. In UEFI, enable Secure Boot. For more information about how to do so, see Secure Boot.

Procedure

1. Open the XML configuration of the Windows VM. The following example opens the configuration of the Example-L1 VM:

   # virsh edit Example-L1

2. Under the <cpu> section, specify the CPU mode and add the policy flag.

   Important
   • For Intel CPUs, enable the vmx policy flag.
   • For AMD CPUs, enable the svm policy flag.
   • If you do not want to specify a custom CPU, you can set the <cpu mode> as host-passthrough.

   <cpu mode='custom' match='exact' check='partial'>
       <model fallback='allow'>Skylake-Client-IBRS</model>
       <topology sockets='1' dies='1' cores='4' threads='1'/>
       <feature policy='require' name='vmx'/>
   </cpu>

3. Save the XML configuration and reboot the VM.

4. On the VM’s operating system, navigate to the Core isolation details page:

   Settings > Update & Security > Windows Security > Device Security > Core isolation details

5. Toggle the switch to enable Memory Integrity.

6. Reboot the VM.

   Note

   For other methods of enabling HVCI, see the relevant Microsoft documentation.

Procedure

1. Optional: Ensure your system’s polkit control policies related to libvirt are set up according to your preferences.

   1. Find all libvirt-related files in the /usr/share/polkit-1/actions/ and /usr/share/polkit-1/rules.d/ directories.

      # ls /usr/share/polkit-1/actions | grep libvirt
      # ls /usr/share/polkit-1/rules.d | grep libvirt

   2. Open the files and review the rule settings.

      For information about reading the syntax of polkit control policies, use man polkit.

   3. Modify the libvirt control policies. To do so:

      1. Create a new .rules file in the /etc/polkit-1/rules.d/ directory.

      2. Add your custom policies to this file, and save it.

         For further information and examples of libvirt control policies, see the libvirt upstream documentation.

2. Configure your VMs to use access policies determined by polkit.

   To do so, find all configuration files for virtualization drivers in the /etc/libvirt/ directory, and uncomment the access_drivers = [ "polkit" ] line in them.

   # find /etc/libvirt/ -name virt*d.conf -exec sed -i 's/#access_drivers = \[ "polkit" \]/access_drivers = \[ "polkit" \]/g' {} +

3. For each file that you modified in the previous step, restart the corresponding service.

   For example, if you have modified /etc/libvirt/virtqemud.conf, restart the virtqemud service.

   # systemctl try-restart virtqemud

Procedure

1. Open the configuration of the VM that you want to assign a VNC password to.

   # virsh edit <vm-name>

2. On the <graphics> line of the configuration, add the passwd attribute and the password string. The password must be 8 characters or fewer.

    <graphics type='vnc' ports='-1' autoport=yes listen=127.0.0.1 passwd='<password>'>

   • Optional: In addition, define a date and time when the password will expire.

      <graphics type='vnc' ports='-1' autoport=yes listen=127.0.0.1 passwd='<password>' passwdValidTo='2025-02-01T15:30:00'>

     In this example, the password will expire on February 1st 2025, at 15:30 UTC.

3. Save the configuration.

Verification

1. Start the modified VM.

   # virsh start <vm-name>

2. Open a graphical console of the VM, for example by using the virt-viewer utility:

   # virt-viewer <vm-name>

   If the VNC password has been configured properly, a dialog window appears that requests you to enter the password.