Comment 103 for bug 2059809

Revision history for this message
Sylvain Bauza (sylvain-bauza) wrote : Re: Arbitrary file access through QCOW2 external data file

@John, if you read patch #2 just proposed by Dan, we will refuse some image if the format is different from the one that was claimed.

Pasting the snippet here for worth the context :
+ disk_format = img['disk_format']
+ try:
+ # NOTE(danms): Use our own cautious inspector module to make sure
+ # the image file passes safety checks.
+ # See https://bugs.launchpad.net/nova/+bug/2059809 for details.
+ inspector_cls = format_inspector.get_inspector(disk_format)
+ if not inspector_cls.from_file(path).safety_check():
+ raise exception.ImageUnacceptable(
+ image_id=image_href,
+ reason=(_('Image does not pass safety check')))
+ except format_inspector.ImageFormatError:
+ # If the inspector we chose based on the image's metadata does not
+ # think the image is the proper format, we refuse to use it.
+ raise exception.ImageUnacceptable(
+ image_id=image_href,
+ reason=_('Image content does not match disk_format'))

In the case of a claimed RAW disk but actually a nasty QCOW2 image, the format inspector would raise that ImageFormatError exception so we wouldn't accept it.

I'm not an image specialist but I assume that when eating chunks of the QCOW2 image by the default format inspector (which is used for raw), we would spit the file due to the qcow2 headers in there.

Dan, can you confirm that assumption please ?
I can also doublecheck that with a devstack environment, if needed.