Comment 12 for bug 1524274

Revision history for this message
Nikola Đipanov (ndipanov) wrote : Re: Unprivileged api user can access host data using instance snapshot

Some comments on the patch from comment #6

@@ -1356,10 +1357,23 @@ class LibvirtDriver(driver.ComputeDriver):

         snapshot = self._image_api.get(context, image_id)

- disk_path = libvirt_utils.find_disk(virt_dom)
- source_format = libvirt_utils.get_disk_type(disk_path)
+ # source_format is an on-disk format
+ # source_type is a backend type
+ disk_path, source_format = libvirt_utils.find_disk(virt_dom)
+ source_type = libvirt_utils.get_disk_type_from_path(disk_path)

So the problem with using source_type derived from the file we find in disk_path is actually that we use it to instantiate the image backend class further down

https://github.com/openstack/nova/blob/b5890b3c36613919338f83c4f59225f424c99cb1/nova/virt/libvirt/driver.py#L1421-L1422

But we really do not need this information at all here, we should really just be calling

  snapshot_backend = self.image_backend.snapshot(instance, disk_path)

as the format will be taken care of by the resolve_driver_format() method of the backend which then looks at the stored format in the disk_info_path file.

I agree that this patch probably fixes the issue, but does it in a way that is slightly different from the mechanism for doing this that we already have in place - the resolve_driver_format method (and seems to require more code). We should go for the simplest/most confined solution if possible.