Re: [PATCH 2/4] doc: add storage format entries

[Eric Blake <eblake@xxxxxxxxxx>]

On 02/26/2013 05:42 AM, Philipp Hahn wrote:
> Add format/@type entries to examples to show what the text is talking
> about.
> 
> Signed-off-by: Philipp Hahn <hahn@xxxxxxxxxxxxx>
> ---
>  docs/storage.html.in |    4 ++++
>  1 file changed, 4 insertions(+)


> +++ b/docs/storage.html.in
> @@ -185,6 +185,7 @@
>          &lt;name&gt;virtimages&lt;/name&gt;
>          &lt;source&gt;
>            &lt;device path="/dev/VolGroup00/VirtImages"/&gt;
> +          &lt;format type="auto"/&gt;
>          &lt;/source&gt;

Question - is type="auto" safe, or does it risk the CVE where a raw
image can be abused by a guest in a manner to make libvirt mis-detect
the storage as some other type, and potentially causing libvirt to
follow a backing chain outside of the guest's permitted reach?

Depending on the answer, either this is safe to push as-is into 1.0.3,
or we should revisit all mention of type="auto" to clarify the danger of
relying on probing.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list