Comment 10 for bug 1206081

Revision history for this message
Pádraig Brady (p-draigbrady) wrote : Re: Unchecked qcow2 root disk sizes DoS

Lets summarize _this_ bug as "per _image_ qcow2 root disk sizes DoS"
and bug 1177830 as "per _instance_ qcow2 root disk sizes DoS".

Unfortunately I think that even bug 1177830 mightn't be addressed in the case
where use_cow_images=False, i.e. in nova.virt.libvirt.imagebackend.Raw.create_image().
On initial inspection it seems like the large qcow2 files could be copied to each instance here too.

So thoughts on addressing this.

1. Always set min_disk = virt_size for an image in glance.
This is already checked in nova before we download anything.
That has the advantage of saving on network bandwidth and is
honored by cinder too for volumes.

2. Pass/Inspect size into nova.virt.images.fetch{,_to_raw}()
and disallow disk.get_disk_size('tmp_download') > size

Doing either should address both bugs I think,
but I'm leaning towards 1 as a more general solution.