From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33860) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ya20C-0006bz-BF for qemu-devel@nongnu.org; Mon, 23 Mar 2015 09:02:48 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Ya207-00035c-E4 for qemu-devel@nongnu.org; Mon, 23 Mar 2015 09:02:44 -0400 Message-ID: <55100EE1.4010401@redhat.com> Date: Mon, 23 Mar 2015 07:02:25 -0600 From: Eric Blake MIME-Version: 1.0 References: <1427105099-12889-1-git-send-email-armbru@redhat.com> <1427105099-12889-2-git-send-email-armbru@redhat.com> In-Reply-To: <1427105099-12889-2-git-send-email-armbru@redhat.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Jnl3bq4vJQw69I0C99gi7uXe7Fl3DbVWq" Subject: Re: [Qemu-devel] [PATCH for-2.3 1/1] block: New command line option --misc format-probing=off List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Markus Armbruster , qemu-devel@nongnu.org Cc: kwolf@redhat.com, stefanha@redhat.com, qemu-block@nongnu.org, mreitz@redhat.com This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Jnl3bq4vJQw69I0C99gi7uXe7Fl3DbVWq Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 03/23/2015 04:04 AM, Markus Armbruster wrote: > Probing is convenient, but probing untrusted raw images is insecure > (CVE-2008-2004). To avoid it, users should always specify raw format > explicitly. This isn't trivial, and even sophisticated users have > gotten it wrong (libvirt CVE-2010-2237, CVE-2010-2238, CVE-2010-2239, > plus more recent variations of the theme that didn't get CVEs because > they were caught before they could hurt users). >=20 > Disabling probing entirely is a (hamfisted) way to ensure you always > specify the format. >=20 > Instead of creating yet another simple option that doesn't work with > -readconfig, create a "misc" option group and --misc command line > option. We're out of space in vm_config_groups[], so double it. >=20 > This will let us make existing miscellaneous non-QemeOpts options s/Qeme/Qemu/ maintainer can fix this > sugar for --misc, so they become available with -readconfig. Left for > another day. >=20 > Signed-off-by: Markus Armbruster > --- > block.c | 6 ++++++ > include/block/block.h | 2 ++ > qemu-options.hx | 15 +++++++++++++++ > util/qemu-config.c | 2 +- > vl.c | 22 ++++++++++++++++++++++ > 5 files changed, 46 insertions(+), 1 deletion(-) >=20 Reviewed-by: Eric Blake Also, I made sure that query-command-line-options includes this (slightly prettified): {"parameters": [{"name": "format-probing", "type": "boolean"}], "option": "misc"}, which I then paired with my pending libvirt patch; as well as experimentation with giving images without a format, all to give: Tested-by: Eric Blake --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --Jnl3bq4vJQw69I0C99gi7uXe7Fl3DbVWq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJVEA7hAAoJEKeha0olJ0Nq9LIH/0zF/ZIAMa0RPc+ZQUvPUAkd 9E2oZuroiaF5Qf0A+bBiO5aT1pVDZABUq/qoAXUL76rm5PRA4X0/tKszs72HDS15 o6iyp5qbnAGA9eFXemb9s12QHiA9JdWc4tRzbknynN6ZbCk0tZrwKTb37ISyrIhd G2lCjWX0IJzIvfLrYRz2ZebS5/Yhvj/5n/RjUCf4jhVAqGmQ7w07m+c8rcKyxdJV CQPgHNGcrW2YV+9Z+5QZJjFbVeKVlGnjkvseKpF0zC60wgdi08qREs4HmRmiaTrl wJjhlL5Sg/McT3D+FlSFTVv5ovi+HbVY+FIKEji/GpW3M+uelibiTvxp4YKY+mA= =Y/ly -----END PGP SIGNATURE----- --Jnl3bq4vJQw69I0C99gi7uXe7Fl3DbVWq--