[Qemu-devel] [PATCH v2] vl.c: disallow command line fw cfg without opt/

["Michael S. Tsirkin" <mst@redhat.com>]

Allowing arbitary file names on command line is setting us up for
failure: future guests will look for a specific QEMU-specified name and
will get confused finding a user file there.

We do warn but people are conditioned to ignore warnings by now,
so at best that will help users debug problem, not avoid it.

Disable this by default, so distros don't get to deal with it,
but leave an option for developers to configure this in,
with scary warnings so people only do it if they know
what they are doing.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---

changes from v1:
    add configure option

 configure | 7 +++++++
 vl.c      | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/configure b/configure
index 2b32876..e5a692f 100755
--- a/configure
+++ b/configure
@@ -256,6 +256,7 @@ sysconfdir="\${prefix}/etc"
 local_statedir="\${prefix}/var"
 confsuffix="/qemu"
 slirp="yes"
+unsafe_fw_cfg="no"
 oss_lib=""
 bsd="no"
 linux="no"
@@ -875,6 +876,8 @@ for opt do
   ;;
   --enable-vnc-png) vnc_png="yes"
   ;;
+  --enable-unsafe-fw-cfg) unsafe_fw_cfg="yes"
+  ;;
   --disable-slirp) slirp="no"
   ;;
   --disable-uuid) uuid="no"
@@ -1286,6 +1289,7 @@ Advanced options (experts only):
                            Available backends: $($python $source_path/scripts/tracetool.py --list-backends)
   --with-trace-file=NAME   Full PATH,NAME of file to store traces
                            Default:trace-<pid>
+  --enable-unsafe-fw-cfg   Enable loading fw cfg entries at unsafe paths (broken! don't use in production!)
   --disable-slirp          disable SLIRP userspace network connectivity
   --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)
   --oss-lib                path to OSS library
@@ -4911,6 +4915,9 @@ fi
 if test "$profiler" = "yes" ; then
   echo "CONFIG_PROFILER=y" >> $config_host_mak
 fi
+if test "$unsafe_fw_cfg" = "yes" ; then
+  echo "CONFIG_UNSAFE_FW_CFG=y" >> $config_host_mak
+fi
 if test "$slirp" = "yes" ; then
   echo "CONFIG_SLIRP=y" >> $config_host_mak
   echo "CONFIG_SMBD_COMMAND=\"$smbd\"" >> $config_host_mak
diff --git a/vl.c b/vl.c
index 7a28982..5adf217 100644
--- a/vl.c
+++ b/vl.c
@@ -2321,6 +2321,9 @@ static int parse_fw_cfg(void *opaque, QemuOpts *opts, Error **errp)
     if (strncmp(name, "opt/", 4) != 0) {
         error_report("warning: externally provided fw_cfg item names "
                      "should be prefixed with \"opt/\"");
+#ifndef CONFIG_UNSAFE_FW_CFG
+        return -1;
+#endif
     }
     if (nonempty_str(str)) {
         size = strlen(str); /* NUL terminator NOT included in fw_cfg blob */
-- 
MST