I'm worried about the attack surface that the linux kernel networking stack, including nic drivers and packet filtering, offers to a remote attacker. So I'm planning to isolate as much of the networking code (drivers, packet filtering etc) in a KVM virtual machine (Basically what Qubes OS is doing, but with kvm instead of the type 1 xen hypervisor)
AFAIK, there are two ways to achieve this: Either pass through the host's ethernet device using PCI passthrough, which has the advantage that we can use the machine's IOMMU hardware to isolate DMA, or use an ethernet device attached via USB and pass through the USB device to the virtual machine. In both cases, it's then the virtual machine kernel that actually does the low-level networking. I would use PCI passthrough of the mainboard's NIC, but for several reasons that turns out not to be an option, so I'm looking at USB passthrough of an ethernet-to-usb dongle.
- Am I right in assuming that with both methods (PCI & USB passthrough), I'm actually reducing the attack surface in the host kernel in regards to networking? In my mind, with that solution, the host kernel simply passes through data to the virtual machine and none of the network traffic touches any part of host kernel's networking code. Is that right?
- Are there glaring problems with passing through a device via USB that renders the isolation of networking in the virtual machine useless/pointless? I'm not worried about the physical security of the machine, e.g. I don't have to defend against someone plugging in a rogue USB adapter that would convince the host's USB 3 controller to do anything it wasn't supposed to do. My main goal ist to make remote exploits more difficult.
- Is the whole endeavour a lost cause? E.g. am I worried about holes in a tried-and-true part of the kernel, while adding a larger attack surface to the system by using virtualization? Am I actually decreasing the overall security of the system by using KVM?