Historically there has been no default policy on command usage in
the QEMU guest agent. A wide variety of commands have been added
for various purposes

 * Co-ordinating host mgmt tasks (FS freezing, CPU hotplug,
   memory block hotplug)
 * Guest information querying (CPU stats, mount info, etc)
 * Arbitrary file read/write and command execution
 * User account auth setup (passwords, SSH keys)

All of these have valid use cases, but they come with very different
levels of risk to the guest OS.

The commands supporting alteration of user authentication credentials
are giving the guest agent client effectively unrestricted access to
do anything at all in the guest OS by enabling them to subsequently
access a user login shell.

The guest agent client is the host OS, so in effect running the QEMU
guest agent gives the host admin a trivial direct backdoor into the
guest OS.

In the absense of confidential computing, the host admin already has
to be considered largely trustworthy, as they will typically have
direct access to any guest RAM regardless.

None the less, to limit their exposure, guest OS admins may choose
to limit these commands by passing '--no-user-auth' / '-e' to
QGA

The --allowedrpcs / --blockedrpcs arguments take precedence over the
--unrestricted arg (whether present or not), thus allowing fine tuning
the defaults further.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 qga/main.c           | 15 +++++++++++++++
 qga/qapi-schema.json |  5 ++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/qga/main.c b/qga/main.c
index 66068ad535..0d792cd92e 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -88,6 +88,7 @@ struct GAConfig {
     GList *allowedrpcs;
     bool only_confidential;
     bool no_unrestricted;
+    bool no_user_auth;
     int daemonize;
     GLogLevelFlags log_level;
     int dumpconf;
@@ -436,6 +437,16 @@ static bool ga_command_is_allowed(const QmpCommand *cmd, GAState *state)
         allowed = false;
     }
 
+    /*
+     * If user auth commands are not allowed that sets
+     * a new default, but an explicit allow/block list can
+     * override
+     */
+    if (config->no_user_auth &&
+        qmp_command_has_feature(cmd, QAPI_FEATURE_USER_AUTH)) {
+        allowed = false;
+    }
+
     if (config->allowedrpcs) {
         /*
          * If an allow-list is given, this changes the fallback
@@ -1220,6 +1231,7 @@ static void config_parse(GAConfig *config, int argc, char **argv)
         { "retry-path", 0, NULL, 'r' },
         { "confidential", 0, NULL, 'i' },
         { "no-unrestricted", 0, NULL, 'u' },
+        { "no-user-auth", 0, NULL, 'e' },
         { NULL, 0, NULL, 0 }
     };
 
@@ -1322,6 +1334,9 @@ static void config_parse(GAConfig *config, int argc, char **argv)
         case 'u':
             config->no_unrestricted = true;
             break;
+        case 'e':
+            config->no_user_auth = true;
+            break;
         case 'h':
             usage(argv[0]);
             exit(EXIT_SUCCESS);
diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index a4f8653446..25068b8110 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -45,7 +45,10 @@
         'confidential',
         # Commands which allow unrestricted access to or
         # modification of guest files or execute arbitrary commands
-        'unrestricted'
+        'unrestricted',
+        # Commands which allow changes to user account
+        # authentication credentials (keys, passwords)
+        'user-auth'
     ] } }
 
 ##
-- 
2.45.1