• Supported Versions
• Reporting a Vulnerability
• Disclosure Policy
• Security Considerations
• Trust Boundaries

MacXVM is pre-1.0. Every fix lands on main and in the next release.

Please do not open a public issue for a security problem.

Report it privately through the security advisory form of the repository:

https://github.com/shadow-x78/macxvm/security/advisories/new

Include the version of MacXVM, the version of QEMU, the output of macxvm doctor and the steps that reproduce the problem. Please do not attach a disk image, a configuration file or anything from a guest.

You will get an acknowledgement within a week, and a fix or an explanation when the report has been confirmed.

A vulnerability is fixed in a release, and the advisory is published together with the release notes. The reporter is credited, unless they prefer to stay anonymous.

The guest runs code from the internet. A macOS guest in a virtual machine receives the same updates and the same malware as a physical machine. Keep the automatic updates of the guest under control, and remember that the slimming level 1 switches them off on purpose, because a system update can break the boot of such a guest.

The QMP socket is not authenticated. It lives in the run directory, which MacXVM only uses when it is a real directory of the current user that no other user may write to. A local user who can reach that socket can control the guest, so the directory must not be shared.

The SSH connections do not verify the host key. The guest is reached through a loopback port, and the key of the guest changes with every installation. Every value that comes from the user is quoted for the remote shell, and the arguments of the commands are always vectors, never a shell string.

The paths of a fetch stay inside the project. A fetch list of a cloned repository may not write anywhere else on the host, so that building a project of somebody else cannot overwrite a file of yours.

The name of a stored configuration is checked. Every path of the state directory is built from the name that config.json holds, so a configuration whose name is not a valid VM name is refused when it is read. A broken or a hand-edited file cannot make a delete reach outside of the state directory.

MacXVM never runs as root. If a step needs root on the host, the tool prints the command for you and exits. It never calls sudo itself.

The boot assets are yours. MacXVM ships no Apple software, no firmware, no boot loader and no keys. The machine definition, the bootloader, the firmware and the installer image come from you, and you are responsible for them. The command macxvm image prepare fetches the installer of Apple and the OpenCore boot loader for you, but only when you ask for it, and never into the repository.