From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:55475)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kwolf@redhat.com>) id 1Xnl3N-0006uA-45
	for qemu-devel@nongnu.org; Mon, 10 Nov 2014 04:14:35 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kwolf@redhat.com>) id 1Xnl3H-0002Dz-08
	for qemu-devel@nongnu.org; Mon, 10 Nov 2014 04:14:29 -0500
Received: from mx1.redhat.com ([209.132.183.28]:35441)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kwolf@redhat.com>) id 1Xnl3G-0002Db-PD
	for qemu-devel@nongnu.org; Mon, 10 Nov 2014 04:14:22 -0500
Received: from int-mx10.intmail.prod.int.phx2.redhat.com
	(int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23])
	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id sAA9ELjU003723
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=FAIL)
	for <qemu-devel@nongnu.org>; Mon, 10 Nov 2014 04:14:21 -0500
Date: Mon, 10 Nov 2014 10:14:19 +0100
From: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20141110091419.GA4158@noname.str.redhat.com>
References: <87lhnq3iul.fsf@blackfin.pond.sub.org>
	<20141105110140.GC6198@noname.str.redhat.com>
	<87tx2csa8c.fsf@blackfin.pond.sub.org>
	<20141106150121.GD4409@noname.redhat.com>
	<878ujn9gu5.fsf@blackfin.pond.sub.org>
	<20141107173333.GD18539@localhost.localdomain>
	<871tpb4gq5.fsf@blackfin.pond.sub.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <871tpb4gq5.fsf@blackfin.pond.sub.org>
Subject: Re: [Qemu-devel] Image probing: how it can be insecure,
 and what we could do about it
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Markus Armbruster <armbru@redhat.com>
Cc: Jeff Cody <jcody@redhat.com>, qemu-devel@nongnu.org, Stefan Hajnoczi <stefanha@redhat.com>, Max Reitz <mreitz@redhat.com>

Am 10.11.2014 um 09:12 hat Markus Armbruster geschrieben:
> Jeff Cody <jcody@redhat.com> writes:
> > So that would mean .img would always require format=, right?
> >
> > That also implies to me that the only extensions for raw that might
> > not require format= would be .iso and .raw.
> 
> .img means what we choose it to mean.
> 
> If we choose "can mean anything, including raw", then .img always
> requires an explicit format with this approach.
> 
> If we choose "means raw", then same as above, except you can omit
> format=raw, and you become prone to opening existing non-raw formats
> raw, which can be bad.

My current thoughts about .img are that we need to consider that

(a) it is occasionally used for multiple image formats and making it
    raw unconditionally is going to cause corruption.

(b) looking at file extensions is absolutely useless if we exlucde
    .img from the automatic detection because it's still the main
    extension for raw.

The common case could probably be covered by bringing probing back into
the game: If an .img file successfully probes for a non-raw format,
error out, avoiding the corruption. If it doesn't, assume raw.

Kevin