Minimizing risks: Running windums in a VM (KVM/Qemu)
Much against my will, my daughter has to use windums in school ("dum" in Danish means "dumb, stupid, idiotic).
My current idea of a solution is to install windums in a KVM/Qemu VM and try to figure out how to use Timekpr-nExt to limit its usage to school hours.
I have found guides to setup the VM and windums (and to remove/suppress some functionalities) and it seems to work.
My questions are:
1) what kind of access does geust systems have to the host system under KVM/Qemu?
2) how can I minimize windums' access to the host system?
You could also use winboat. You have to have shared folders function on and then use Desktop mode to go to the folder you need. Z: for example, then the file you want to run, etc...
Of course the best option would be to not need windows at all.
But of course we know that isn't always possible for everyone in this foolish world.
Here's a good writeup of some options, depending on what you do and don't want to share:
https://unix.stackexchange.com/questions/451306/qemu-windows-guest-without-internet-but-with-a-shared-folder
$ qemu-system-x86_64 -net nic -net user,restrict=on,smb=/path/to/shared/folder ...
restrict=on appears to be one of the key elements for safeguarding the host:
>"restrict=on|off
If this option is enabled, the guest will be isolated, i.e. it
will not be able to contact the host and no guest IP packets
will be routed over the host to the outside. This option does
not affect any explicitly set forwarding rules."
Oh never seen the restrict option, interesting.
If you are being provided a machine, do they allow booting it from USB? I think probably not, but if so, you could boot from a live usb install qemu, boot the nvme with the -drive option. https://www.qemu.org/docs/master/system/images.html
You can also put the nvme disk on a enclosure and boot the qemu disk from there. I disconnected the device from the USB briefly while using it as a host, and it is amazing it holds up if I recall correctly.
In the UEFI/BIOS, there must be an option (VT-D VMD controller for my laptop) to turn off on AHCI to not support RAID, like I had to turn off so that you can "bind the host NVMe controller to the host vfio-pci driver".
I think it is scary the situation that employers/schools are forcing people into, that it maybe even illegal to do this. I don't know.
EDIT: Apparently, I did this off the top of my head because remembering settings between boots is hard.