KVM Forum 2021

rust-vmm is an open-source project that provides a set of reusable virtualization components that can be leveraged for building custom Virtual Machine Monitors (VMMs). One of the durable advantages of the rust-vmm project is the security and testability of each component. The virtualization components in rust-vmm have clear entry points, so that makes them a nice target for security testing such as fuzzing. But is it really that easy to achieve? In this talk we take a look at the multiple facets we have to consider when adding security testing. We will focus our attention on 3 aspects: * how we prepare a Rust component for security testing * how we can maintain the balance between transparency and customer trust when running fuzzing in an open source project, and * the peculiarities of fuzzing virtualization components. We will also take a look at our findings and lessons learned.