Re: [kata-dev] Booting OVMF with -bios?

On 01/07/21 18:33, Dr. David Alan Gilbert wrote:

in some ways you're trading off host-guest security against guest security there.

This is a great way to put it IMO; the question is whether SB -- normally, a barrier between guest components -- buys the guest owner any actual security in this use case. If the guest owner controls both the guest firmware and the guest OS completely, there likely is no threat that the guest OS might somehow undermine the guest firmware (e.g., get hacked and install a permanent UEFI rootkit on the UEFI system partition, or whatever). TBH the *intersections* of these security technologies / threat models are a bit mind-boggling, to me anyway. Laszlo