While our code can detect ISO as a separate format, qemu does not use it as such and just passes it through as raw. Add conversion for detected parts of the backing chain so that the validation code does not reject it right away. Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- src/qemu/qemu_domain.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 446a517df9..a28b51c10e 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -11493,6 +11493,10 @@ qemuDomainDetermineDiskChain(virQEMUDriverPtr driver, return -1; for (n = src->backingStore; virStorageSourceIsBacking(n); n = n->backingStore) { + /* convert detected ISO format to 'raw' as qemu would not understand it */ + if (n->format == VIR_STORAGE_FILE_ISO) + n->format = VIR_STORAGE_FILE_RAW; + if (qemuDomainValidateStorageSource(n, priv->qemuCaps) < 0) return -1; -- 2.24.1

Allow format probing to work around lazy clients which did not specify their format in the overlay. Format probing will be allowed only, if we are able to probe the image, the probing result was successful and the probed image does not have any backing or data file. This relaxes the restrictions which were imposed in commit 3615e8b39bad in cases when we know that the image probing will not result in security issues or data corruption. We perform the image format detection and in the case that we were able to probe the format and the format does not specify a backing store (or doesn't support backing store) we can use this format. With pre-blockdev configurations this will restore the previous behaviour for the images mentioned above as qemu would probe the format anyways. It also improves error reporting compared to the old state as we now report that the backing chain will be broken in case when there is a backing file. In blockdev configurations this ensures that libvirt will not cause data corruption by ending the chain prematurely without notifying the user, but still allows the old semantics when the users forgot to specify the format. Users thus don't have to re-invent when image format detection is safe to do. The price for this is that libvirt will need to keep the image format detector still current and working or replace it by invocation of qemu-img. Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- src/util/virstoragefile.c | 52 ++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 22 deletions(-) diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c index d75d2a689a..b133cf17f1 100644 --- a/src/util/virstoragefile.c +++ b/src/util/virstoragefile.c @@ -4986,6 +4986,7 @@ virStorageFileGetMetadataRecurse(virStorageSourcePtr src, virHashTablePtr cycle, unsigned int depth) { + virStorageFileFormat orig_format = src->format; size_t headerLen; int rv; g_autofree char *buf = NULL; @@ -4995,10 +4996,17 @@ virStorageFileGetMetadataRecurse(virStorageSourcePtr src, NULLSTR(src->path), src->format, (unsigned int)uid, (unsigned int)gid); + if (src->format == VIR_STORAGE_FILE_AUTO_SAFE) + src->format = VIR_STORAGE_FILE_AUTO; + /* exit if we can't load information about the current image */ rv = virStorageFileSupportsBackingChainTraversal(src); - if (rv <= 0) + if (rv <= 0) { + if (orig_format == VIR_STORAGE_FILE_AUTO) + return -2; + return rv; + } if (virStorageFileGetMetadataRecurseReadHeader(src, parent, uid, gid, &buf, &headerLen, cycle) < 0) @@ -5007,6 +5015,18 @@ virStorageFileGetMetadataRecurse(virStorageSourcePtr src, if (virStorageFileGetMetadataInternal(src, buf, headerLen) < 0) return -1; + /* If we probed the format we MUST ensure that nothing else than the current + * image (this includes both backing files and external data store) is + * considered for security labelling and/or recursion. */ + if (orig_format == VIR_STORAGE_FILE_AUTO) { + if (src->backingStoreRaw || src->externalDataStoreRaw) { + src->format = VIR_STORAGE_FILE_RAW; + VIR_FREE(src->backingStoreRaw); + VIR_FREE(src->externalDataStoreRaw); + return -2; + } + } + if (src->backingStoreRaw) { if ((rv = virStorageSourceNewFromBacking(src, &backingStore)) < 0) return -1; @@ -5015,33 +5035,21 @@ virStorageFileGetMetadataRecurse(virStorageSourcePtr src, if (rv == 1) return 0; - if (backingStore->format == VIR_STORAGE_FILE_AUTO) { - /* Assuming the backing store to be raw can lead to failures. We do - * it only when we must not report an error to prevent losing VMs. - * Otherwise report an error. - */ - if (report_broken) { + if ((rv = virStorageFileGetMetadataRecurse(backingStore, parent, + uid, gid, + report_broken, + cycle, depth + 1)) < 0) { + if (!report_broken) + return 0; + + if (rv == -2) { virReportError(VIR_ERR_OPERATION_INVALID, _("format of backing image '%s' of image '%s' was not specified in the image metadata " "(See https://libvirt.org/kbase/backing_chains.html for troubleshooting)"), src->backingStoreRaw, NULLSTR(src->path)); - return -1; } - backingStore->format = VIR_STORAGE_FILE_RAW; - } - - if (backingStore->format == VIR_STORAGE_FILE_AUTO_SAFE) - backingStore->format = VIR_STORAGE_FILE_AUTO; - - if (virStorageFileGetMetadataRecurse(backingStore, parent, - uid, gid, - report_broken, - cycle, depth + 1) < 0) { - if (report_broken) - return -1; - else - return 0; + return -1; } backingStore->id = depth; -- 2.24.1

Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/kbase/backing_chains.rst | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/docs/kbase/backing_chains.rst b/docs/kbase/backing_chains.rst index 3b3f0583e5..12ed6253ac 100644 --- a/docs/kbase/backing_chains.rst +++ b/docs/kbase/backing_chains.rst @@ -46,14 +46,17 @@ system used on the host so that the hypervisor can access the files and possibly also directly to configure the hypervisor to use the appropriate images. Thus it's important to properly setup the formats and paths of the backing images. +Any externally created image should always use the -F switch of ``qemu-img`` +to specify the format of the backing file to avoid probing. + Image detection caveats ----------------------- Detection of the backing chain requires libvirt to read and understand the ``backing file`` field recorded in the image metadata and also being able to recurse and read the backing file. Due to security implications libvirt -will not attempt to detect the format of the backing image if the image metadata -doesn't contain it. +will refuse to use backing images of any image whose format was not specified +explicitly in the XML or the overlay image itself. Libvirt also might lack support for a network disk storage technology and thus may be unable to visit and detect backing chains on such storage. This may @@ -104,6 +107,8 @@ Note that it's also possible to partially specify the chain in the XML but omit the terminating element. This will result into probing from the last specified ``<backingStore>`` +Any image specified explicitly will not be probed for backing file or format. + Manual image creation ===================== @@ -113,6 +118,13 @@ them properly so that they work with libvirt as expected. The created disk images must contain the format of the backing image in the metadata. This means that the **-F** parameter of ``qemu-img`` must always be used. +:: + + qemu-img -f qcow2 -F qcow2 -b /path/to/backing /path/to/overlay + +Note that if '/path/to/backing' is relative the path is considered relative to +the location of '/path/to/overlay'. + Troubleshooting =============== -- 2.24.1