Re: [Qemu-devel] live snapshot wiki updated

[Stefan Hajnoczi]

On Thu, Jul 21, 2011 at 3:02 PM, Eric Blake <address@hidden> wrote:
> Thank you for persisting - you've found another hole that needs to be
> plugged.  It sounds like you are proposing that after a qemu process dies,
> that libvirt re-reads the qcow2 metadata headers, and validates that the
> backing file information has not changed in a manner unexpected by libvirt.
>  If it has, then the qemu process that just died was compromised to the
> point that restarting a new qemu process from the old image is now a
> security risk.  So this is _yet another_ security aspect that needs to be
> coded into libvirt as part of hardening sVirt.

The backing file information changes when image streaming completes.

Before: fedora.img <- my_vm.qed
After: my_vm.qed (fedora.img is no longer referenced)

The image streaming operation copies data out of fedora.img and
populates my_vm.qed.  When image streaming completes, the backing file
is no longer needed and my_vm.qed is updated to drop the backing file.

I think we need to design carefully to prevent QEMU and libvirt making
incorrect assumptions about who does what.  I really wish that all
this image file business was outside QEMU and libvirt - that we had a
separate storage management service which handled the details.  QEMU
would only do block device operations (no image format manipulation),
and libvirt would only delegate to the storage management service.
Today we seem to be sprinkling a little bit of storage management into
QEMU and a little bit into libvirt :(.

In that spirit it is much nicer to think of storage like a SAN
appliance where you have LUNs that you access as block devices.  It
also provides an API for snapshotting, cloning LUNs, etc.

Let's move to that model instead of worrying about how to spread
storage logic across QEMU and libvirt.

Stefan