Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk
Am 09.03.2020 um 16:44 hat Daniel P. Berrangé geschrieben:
We could support "-F ..." and validate any non-raw formats,
while raising a
runtime error in the case of "-F raw", as only the "raw" backing
format has
the probing security risk.
Users who need to use qcow, with a backing file, without a format can
just not pass "-F" and in doing so will be insecure.
Hm, this is actually an interesting option. We wouldn't lose features
compared to today without -F, but we would allow -F when we can verify
that the operation is safe (the image is already non-raw).
We could take this opportunity to deprecate 'qcow' perhaps,
declare it
a read-only format, restricted to qemu-img/qemu-io for purpose of data
liberation ?
I'm against making any format read-only because that immediately means
that it becomes untestable.
For sheepdog, if it is something we genuinely still care about, then
adding a backing file format record seems neccessary, unless we either
forbid use of raw backing files, or forbid use of non-raw backing files,
either way would be safe.
In case of doubt, we can use the same logic as you suggested for qcow
(accept only non-raw with -F, but no restrictions without -F).
Kevin