Architecture

Security model

Current protections, local-only control boundaries, and console authentication.

Wave VM runs as the current user, does not require root, and keeps virtualization control interfaces local. The current build starts real QEMU processes, so the security model now includes process control and a guest display transport.

Current protections

No privileged helper and no request to run as root.
No installation of drivers, changes to group membership, or host configuration changes.
A restrictive Content Security Policy in the Tauri configuration.
A minimal capability set scoped to the main window.
No remote web content loaded into the privileged application window.
Application and machine directories use 0700 permissions; configuration and disks use 0600 on Unix.
QMP uses a private Unix domain socket in the machine directory.
QEMU VNC is bound to 127.0.0.1 and exposed over WebSocket only on loopback.
The console password is generated per run and kept in memory, not in VM configuration.
QEMU is launched with no guest network device.

Local control boundary

The Content Security Policy permits WebSocket connections only to 127.0.0.1. QMP is not a public endpoint, and the VNC listener is not reachable from another host through Wave VM's configuration. The console is a local display feature, not a remote access service.

This is not a security audit

The protections above are implementation choices, not proof that the application is free of vulnerabilities. No independent security audit has been completed.

Input and data handling

Machine names, resources, and disk sizes are validated in Rust. Disk paths are checked to remain inside the Wave VM data directory before launch. QEMU arguments are constructed as vectors, not shell strings. Existing disks are never overwritten.

Imported disk images and ISO files are not supported yet. When media support is added, imported files must be treated as untrusted inputs and verified where reliable data exists.

Known limitations

No security audit has been performed.
No release artifacts or update mechanism exist.
Guest installation media, networking, USB passthrough, snapshots, and machine editing are not implemented.
Cleanup after a force-killed desktop process is not guaranteed for an already running QEMU child.
Linux x86_64 is the only exercised host; Windows and macOS security behavior has not been verified.

Source references

tauri.conf.json — CSP and window configuration.
capabilities/default.json — capability scope.
vm/runtime.rs — QMP, console binding, password generation, and process termination.
config/store.rs — file permissions and atomic writes.

See Storage and configuration for the file layout and Reporting issues for how to report a security-relevant problem without exposing secrets.