[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH 2/4] doc: add storage format entries

On 02/26/2013 05:42 AM, Philipp Hahn wrote:
> Add format/@type entries to examples to show what the text is talking
> about.
> Signed-off-by: Philipp Hahn <hahn univention de>
> ---
>  docs/storage.html.in |    4 ++++
>  1 file changed, 4 insertions(+)

> +++ b/docs/storage.html.in
> @@ -185,6 +185,7 @@
>          &lt;name&gt;virtimages&lt;/name&gt;
>          &lt;source&gt;
>            &lt;device path="/dev/VolGroup00/VirtImages"/&gt;
> +          &lt;format type="auto"/&gt;
>          &lt;/source&gt;

Question - is type="auto" safe, or does it risk the CVE where a raw
image can be abused by a guest in a manner to make libvirt mis-detect
the storage as some other type, and potentially causing libvirt to
follow a backing chain outside of the guest's permitted reach?

Depending on the answer, either this is safe to push as-is into 1.0.3,
or we should revisit all mention of type="auto" to clarify the danger of
relying on probing.

Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]