[Qemu-devel] [RFC PATCH] qemu: enforce no format probing when possible

[Eric Blake <eblake@redhat.com>]

qemu 2.3 added an option, with this documentation:

| Probing is convenient, but probing untrusted raw images is insecure
| (CVE-2008-2004).  To avoid it, users should always specify raw format
| explicitly.  This isn't trivial, and even sophisticated users have
| gotten it wrong (libvirt CVE-2010-2237, CVE-2010-2238, CVE-2010-2239,
| plus more recent variations of the theme that didn't get CVEs because
| they were caught before they could hurt users).
|
| Disabling probing entirely is a (hamfisted) way to ensure you always
| specify the format.

Use it when libvirt is configured to avoid probing, to ensure we
catch libvirt failures on avoiding probing before such bugs can
escalate into another CVE.

* src/qemu/qemu_capabilities.h (QEMU_CAPS_NO_FORMAT_PROBING): New
capability bit.
* src/qemu/qemu_capabilities.c (virQEMUCapsCommandLine): Set it.
* src/qemu/qemu_command.c (qemuBuildCommandLine): Use it.

Signed-off-by: Eric Blake <eblake@redhat.com>
CC: qemu-devel@nongnu.org
---

RFC because I need to enhance the libvirt testsuite to prove we set
the option, and because the qemu side has not been committed yet
(and may therefore change the final spelling for the new option).

 src/qemu/qemu_capabilities.c | 7 +++++--
 src/qemu/qemu_capabilities.h | 3 ++-
 src/qemu/qemu_command.c      | 3 +++
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index ccf22f0..b452a75 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -1,7 +1,7 @@
 /*
  * qemu_capabilities.c: QEMU capabilities generation
  *
- * Copyright (C) 2006-2014 Red Hat, Inc.
+ * Copyright (C) 2006-2015 Red Hat, Inc.
  * Copyright (C) 2006 Daniel P. Berrange
  *
  * This library is free software; you can redistribute it and/or
@@ -279,6 +279,8 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST,
               "qxl.vgamem_mb",
               "qxl-vga.vgamem_mb",
               "pc-dimm",
+
+              "no-format-probing", /* 185 */
     );


@@ -2514,7 +2516,8 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = {
     { "spice", "disable-agent-file-xfer", QEMU_CAPS_SPICE_FILE_XFER_DISABLE },
     { "msg", "timestamp", QEMU_CAPS_MSG_TIMESTAMP },
     { "numa", NULL, QEMU_CAPS_NUMA },
-    { "drive", "throttling.bps-total-max", QEMU_CAPS_DRIVE_IOTUNE_MAX},
+    { "drive", "throttling.bps-total-max", QEMU_CAPS_DRIVE_IOTUNE_MAX },
+    { "no-format-probing", NULL, QEMU_CAPS_NO_FORMAT_PROBING },
 };

 static int
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
index c7b1ac7..2cdcd81 100644
--- a/src/qemu/qemu_capabilities.h
+++ b/src/qemu/qemu_capabilities.h
@@ -1,7 +1,7 @@
 /*
  * qemu_capabilities.h: QEMU capabilities generation
  *
- * Copyright (C) 2006-2014 Red Hat, Inc.
+ * Copyright (C) 2006-2015 Red Hat, Inc.
  * Copyright (C) 2006 Daniel P. Berrange
  *
  * This library is free software; you can redistribute it and/or
@@ -224,6 +224,7 @@ typedef enum {
     QEMU_CAPS_QXL_VGAMEM         = 182, /* -device qxl.vgamem_mb */
     QEMU_CAPS_QXL_VGA_VGAMEM     = 183, /* -device qxl-vga.vgamem_mb */
     QEMU_CAPS_DEVICE_PC_DIMM     = 184, /* pc-dimm device */
+    QEMU_CAPS_NO_FORMAT_PROBING  = 185, /* -no-format-probing */

     QEMU_CAPS_LAST,                   /* this must always be the last item */
 } virQEMUCapsFlags;
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 63d43d4..1085639 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -8672,6 +8672,9 @@ qemuBuildCommandLine(virConnectPtr conn,
             virCommandAddArg(cmd, "-nodefconfig");
         virCommandAddArg(cmd, "-nodefaults");
     }
+    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_NO_FORMAT_PROBING) &&
+        !cfg->allowDiskFormatProbing)
+        virCommandAddArg(cmd, "-no-format-probing");

     /* Serial graphics adapter */
     if (def->os.bios.useserial == VIR_TRISTATE_BOOL_YES) {
-- 
2.1.0