Re: Security

[Richard Hector <richard@walnut.gen.nz>]

On 2/02/22 00:26, Vincent Lefevre wrote:
> On 2022-01-31 01:36:06 +1300, Richard Hector wrote:
> > On 29/01/22 04:17, Vincent Lefevre wrote:
> > > Servers shouldn't have pkexec installed in the first place, anyway.
> >
> > libvirt-daemon-system depends on policykit-1.
> >
> > Should that not be on my (kvm) server either?
>
> I don't need libvirt-daemon-system on my server. And I don't see
> why it would be needed in general. If I understand correctly,
> libvirt is used to manage VMs, but what is mostly exposed on the
> Internet (e.g. as a web server) is the VM itself, which doesn't
> need libvirt.

I guess it depends how you define a 'server'. I include the machine that 
hosts my VMs. And I certainly don't restrict it to what's exposed on the 
Internet.

I admit I haven't explored in depth exactly which bits of libvirt are 
required on the VM host; I rely to some extent on the recommendations in 
the packages.

Cheers,
Richard