Re: QEMU "drive_init()" Disk Format Security Bypass

["Daniel P. Berrange" <berrange@redhat.com>]

On Thu, May 08, 2008 at 06:19:30PM +0100, Ian Jackson wrote:
> Daniel P. Berrange writes ("Re: [Xen-devel] QEMU "drive_init()" Disk Format Security Bypass"):
> > Well, tap:XXX: style URLS already encode the format explicitly. So if
> > we made QEMU understand that syntax too, then that gives admins the 
> > option to be secure, while keeping file: fas a legacy (unsecure) mode
> > for compatability. This has the added advantage that it'd be the same
> > syntax used for PV-on-HVM drivers, and avoids nasty guessing based on
> > filename.
> 
> Yes, encoding the format explicit is definitely the way forward.
> 
> The question is what to do for existing deployments.  Would the users
> prefer to have their system break now or to get rooted in a month or
> two ?

Then disable all format guessing with file: for HVM guests and make it
only use RAW format - this matches semantics of file: with PV guests.
And let them use tap:XXX: if they want QCow with HVM

Dan.
-- 
|: Red Hat, Engineering, Boston   -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org  -o-  http://virt-manager.org  -o-  http://ovirt.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-  F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|