On 03/23/2015 04:04 AM, Markus Armbruster wrote: > Probing is convenient, but probing untrusted raw images is insecure > (CVE-2008-2004). To avoid it, users should always specify raw format > explicitly. This isn't trivial, and even sophisticated users have > gotten it wrong (libvirt CVE-2010-2237, CVE-2010-2238, CVE-2010-2239, > plus more recent variations of the theme that didn't get CVEs because > they were caught before they could hurt users). > > Disabling probing entirely is a (hamfisted) way to ensure you always > specify the format. > > Instead of creating yet another simple option that doesn't work with > -readconfig, create a "misc" option group and --misc command line > option. We're out of space in vm_config_groups[], so double it. > > This will let us make existing miscellaneous non-QemeOpts options
s/Qeme/Qemu/
maintainer can fix this
> sugar for --misc, so they become available with -readconfig. Left for
> another day.
>
> Signed-off-by: Markus Armbruster <arm...@redhat.com>
> ---
> block.c | 6 ++++++
> include/block/block.h | 2 ++
> qemu-options.hx | 15 +++++++++++++++
> util/qemu-config.c | 2 +-
> vl.c | 22 ++++++++++++++++++++++
> 5 files changed, 46 insertions(+), 1 deletion(-)
>
Reviewed-by: Eric Blake <ebl...@redhat.com>
Also, I made sure that query-command-line-options includes this
(slightly prettified):
{"parameters": [{"name": "format-probing",
"type": "boolean"}],
"option": "misc"},
which I then paired with my pending libvirt patch; as well as
experimentation with giving images without a format, all to give:
Tested-by: Eric Blake <ebl...@redhat.com>
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
