Re: [Qemu-devel] [PATCH v4][ 5/7] guest agent: add guest agent RPCs/commands

[Andi Kleen <andi@firstfloor.org>]

Michael Roth <mdroth@linux.vnet.ibm.com> writes:
> +
> +int64_t qmp_guest_file_open(const char *filename, const char *mode, Error **err)
> +{
> +    FILE *fh;
> +    int fd, ret;
> +    int64_t id = -1;
> +
> +    if (!logging_enabled()) {
> +        error_set(err, QERR_QGA_LOGGING_FAILED);
> +        goto out;
> +    }
> +    slog("guest-file-open called, filename: %s, mode: %s", filename, mode);
> +    fh = fopen(filename, mode);
> +    if (!fh) {
> +        error_set(err, QERR_OPEN_FILE_FAILED, filename);
> +        goto out;
> +    }

Does this really allow a guest to open any host file ?!?
Have you considered all the security implications of that?

-Andi

-- 
ak@linux.intel.com -- Speaking for myself only