Comment 29 for bug 1990157

Revision history for this message
Dan Smith (danms) wrote : Re: Malicious image data modification can happen when using COW

I think we really need to have anything like #1 available for all the supported branches if we're going to hold this up for that. I share Brian's concern on that being available in a timely manner. But I also think that it's not a reasonable resolution to the core problem because people using COW boots and snapshots are doing so specifically to *avoid* the need to do long and expensive operations there.

I think that the original OSSN did not clearly prescribe the way out of the box for this and as such we shouldn't use the lack of deployments using two endpoints as a gauge for whether or not people or deployment tools are aware of it. This originally got raised downstream when we were talking to deployment people and specifically asking about a split API horizon for this reason. They had no idea it was needed.

So again I'd say I think the far greater good is getting the information on how to mitigate this for all deployments out to the people. Changes to allow for tighter hashing controls in glance are good, but they're not going to be an acceptable solution for most of the affected users, I think. Deploying a second set of glance workers trades a little memory, which is a lot less expensive than the time and CPU load required for the hashing option.

Just MHO!