Re: [Qemu-devel] [PATCH for-2.3 1/1] block: New command line option --misc format-probing=off

[Eric Blake]

On 03/23/2015 04:04 AM, Markus Armbruster wrote:
> Probing is convenient, but probing untrusted raw images is insecure
> (CVE-2008-2004).  To avoid it, users should always specify raw format
> explicitly.  This isn't trivial, and even sophisticated users have
> gotten it wrong (libvirt CVE-2010-2237, CVE-2010-2238, CVE-2010-2239,
> plus more recent variations of the theme that didn't get CVEs because
> they were caught before they could hurt users).
> 
> Disabling probing entirely is a (hamfisted) way to ensure you always
> specify the format.
> 
> Instead of creating yet another simple option that doesn't work with
> -readconfig, create a "misc" option group and --misc command line
> option.  We're out of space in vm_config_groups[], so double it.
> 
> This will let us make existing miscellaneous non-QemeOpts options

s/Qeme/Qemu/
maintainer can fix this

> sugar for --misc, so they become available with -readconfig.  Left for
> another day.
> 
> Signed-off-by: Markus Armbruster <address@hidden>
> ---
>  block.c               |  6 ++++++
>  include/block/block.h |  2 ++
>  qemu-options.hx       | 15 +++++++++++++++
>  util/qemu-config.c    |  2 +-
>  vl.c                  | 22 ++++++++++++++++++++++
>  5 files changed, 46 insertions(+), 1 deletion(-)
> 

Reviewed-by: Eric Blake <address@hidden>

Also, I made sure that query-command-line-options includes this
(slightly prettified):

 {"parameters": [{"name": "format-probing",
 "type": "boolean"}],
 "option": "misc"},

which I then paired with my pending libvirt patch; as well as
experimentation with giving images without a format, all to give:

Tested-by: Eric Blake <address@hidden>

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

signature.asc
Description: OpenPGP digital signature