Am 09.03.2020 um 16:44 hat Daniel P. Berrangé geschrieben: > We could support "-F ..." and validate any non-raw formats, while raising a > runtime error in the case of "-F raw", as only the "raw" backing format has > the probing security risk. > > Users who need to use qcow, with a backing file, without a format can > just not pass "-F" and in doing so will be insecure. Hm, this is actually an interesting option. We wouldn't lose features compared to today without -F, but we would allow -F when we can verify that the operation is safe (the image is already non-raw). > We could take this opportunity to deprecate 'qcow' perhaps, declare it > a read-only format, restricted to qemu-img/qemu-io for purpose of data > liberation ? I'm against making any format read-only because that immediately means that it becomes untestable. > For sheepdog, if it is something we genuinely still care about, then > adding a backing file format record seems neccessary, unless we either > forbid use of raw backing files, or forbid use of non-raw backing files, > either way would be safe. In case of doubt, we can use the same logic as you suggested for qcow (accept only non-raw with -F, but no restrictions without -F). Kevin
