Comment 58 for bug 2059809

Revision history for this message
Brian Rosmaita (brian-rosmaita) wrote : Re: Arbitrary file access through QCOW2 external data file

Based on what Martin says in comment #57 (responsed to Jeremy), the cinder patch needs more work. From the OpenStack perspective, images in Glance have to be single files. (This can be a single file like an OVA that contains multiple files, which you'd identifiy in glance as having a specific container_format and then you'd also say what format the stuff in the archive is.) For an OVA to "work", the image consumer needs to know how to unpack the container_format and handle its content. I don't know about Nova, but for Cinder, we only do this for OVAs containing VHDs as a leftover artifact of Xen server support, and I think we need to remove this from cinder anyway given that Nova stopped Xen server support a few (maybe many?) cycles ago.

What I'm getting at is that I don't think there's currently a legitimate use case for a qcow2 file with children (as described in comment #50) because there's currently no way to store the children in Glance. So I think we need to deal with this in the same way as the backing file, i.e., if we detect it, reject it. What concerns me were Martin's original comments about 'qemu-img info' triggering the file-corruption-rewrite, but maybe all it does is evaluate the graph to see if everything is in place. (We need verification on that, though.)