Security architecture¶
Multipass architecture¶
Multipass has two parts: clients (the CLI and the GUI) that run as your user, and a privileged daemon that runs on the host and manages instances through a hypervisor. See Reference architecture for a description of each component.
Secure by design¶
Multipass is designed around the question of who can reach the daemon and what they can do with it. This section describes the threats Multipass is designed against and how it mitigates each one.
Other users on the same host¶
Anyone who can talk to the daemon can fully control Multipass, including mounting host folders into instances and changing security settings for all instances. Multipass follows the principle of least privilege to make sure only trusted users get that access.
On Linux and macOS, the daemon listens on a Unix socket. At first, only members of the administrator group (sudo, wheel, or admin, depending on the system) can connect. The first administrator to connect has their TLS certificate accepted automatically. On Windows, the daemon listens on a local TLS socket that all local users can reach, but it only accepts requests other than authenticate from clients with an accepted certificate. On all platforms, every other user must authenticate with a passphrase set by an administrator before the daemon accepts their requests. See Authentication for the details.
A compromised instance¶
Multipass uses defense in depth, so that the failure of one layer does not expose the whole host:
The hypervisor (QEMU, Hyper-V, or Apple Virtualization) isolates each instance from the host.
On Linux, the Multipass snap runs under strict snap confinement, which limits what the daemon can reach on the host, including where mounts can point.
On Windows, mounts are disabled by default.
Mounts are the main way an instance can compromise the host, because the daemon performs them with its own privileges. See Security considerations on the Mount page for the implications on each platform.
Secure development¶
Multipass is open source, so its security does not depend on keeping the design secret. Changes are proposed and reviewed through pull requests on GitHub, and the code is scanned by static analysis every week. On Linux, a daily job checks the Multipass snap against Ubuntu Security Notices and rebuilds the candidate snap when a bundled package has a fix.
Security lifecycle¶
Only the latest stable release of Multipass is supported. Older releases do not receive security fixes, so running one might leave you exposed to known vulnerabilities. Security fixes ship in regular feature or maintenance releases, depending on what else they include.
How you get updates depends on your platform:
Linux: the snap updates automatically. To update straight away, run
sudo snap refresh multipass. You can postpone updates withsudo snap refresh --hold=<duration> multipass, but every day you postpone is a day you run without the latest security fixes.macOS and Windows: Multipass checks for new releases every day and reminds you when one is available. Download and run the new installer to update.
To check that an update has been applied, run multipass version.
See Upgrade for the full instructions and the security policy on GitHub for how security fixes are released.
Reporting vulnerabilities¶
To report a vulnerability, follow the private reporting process in the security policy on GitHub. Published vulnerabilities are listed on the Multipass security advisories page on GitHub and mentioned in the release notes.