@@ -1,7 +1,7 @@
/*
* qemu_capabilities.c: QEMU capabilities generation
*
- * Copyright (C) 2006-2014 Red Hat, Inc.
+ * Copyright (C) 2006-2015 Red Hat, Inc.
* Copyright (C) 2006 Daniel P. Berrange
*
* This library is free software; you can redistribute it and/or
@@ -279,6 +279,8 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST,
"qxl.vgamem_mb",
"qxl-vga.vgamem_mb",
"pc-dimm",
+
+ "no-format-probing", /* 185 */
);
@@ -2514,7 +2516,8 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = {
{ "spice", "disable-agent-file-xfer", QEMU_CAPS_SPICE_FILE_XFER_DISABLE },
{ "msg", "timestamp", QEMU_CAPS_MSG_TIMESTAMP },
{ "numa", NULL, QEMU_CAPS_NUMA },
- { "drive", "throttling.bps-total-max", QEMU_CAPS_DRIVE_IOTUNE_MAX},
+ { "drive", "throttling.bps-total-max", QEMU_CAPS_DRIVE_IOTUNE_MAX },
+ { "no-format-probing", NULL, QEMU_CAPS_NO_FORMAT_PROBING },
};
static int
@@ -1,7 +1,7 @@
/*
* qemu_capabilities.h: QEMU capabilities generation
*
- * Copyright (C) 2006-2014 Red Hat, Inc.
+ * Copyright (C) 2006-2015 Red Hat, Inc.
* Copyright (C) 2006 Daniel P. Berrange
*
* This library is free software; you can redistribute it and/or
@@ -224,6 +224,7 @@ typedef enum {
QEMU_CAPS_QXL_VGAMEM = 182, /* -device qxl.vgamem_mb */
QEMU_CAPS_QXL_VGA_VGAMEM = 183, /* -device qxl-vga.vgamem_mb */
QEMU_CAPS_DEVICE_PC_DIMM = 184, /* pc-dimm device */
+ QEMU_CAPS_NO_FORMAT_PROBING = 185, /* -no-format-probing */
QEMU_CAPS_LAST, /* this must always be the last item */
} virQEMUCapsFlags;
@@ -8672,6 +8672,9 @@ qemuBuildCommandLine(virConnectPtr conn,
virCommandAddArg(cmd, "-nodefconfig");
virCommandAddArg(cmd, "-nodefaults");
}
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_NO_FORMAT_PROBING) &&
+ !cfg->allowDiskFormatProbing)
+ virCommandAddArg(cmd, "-no-format-probing");
/* Serial graphics adapter */
if (def->os.bios.useserial == VIR_TRISTATE_BOOL_YES) {
qemu 2.3 added an option, with this documentation: | Probing is convenient, but probing untrusted raw images is insecure | (CVE-2008-2004). To avoid it, users should always specify raw format | explicitly. This isn't trivial, and even sophisticated users have | gotten it wrong (libvirt CVE-2010-2237, CVE-2010-2238, CVE-2010-2239, | plus more recent variations of the theme that didn't get CVEs because | they were caught before they could hurt users). | | Disabling probing entirely is a (hamfisted) way to ensure you always | specify the format. Use it when libvirt is configured to avoid probing, to ensure we catch libvirt failures on avoiding probing before such bugs can escalate into another CVE. * src/qemu/qemu_capabilities.h (QEMU_CAPS_NO_FORMAT_PROBING): New capability bit. * src/qemu/qemu_capabilities.c (virQEMUCapsCommandLine): Set it. * src/qemu/qemu_command.c (qemuBuildCommandLine): Use it. Signed-off-by: Eric Blake <eblake@redhat.com> CC: qemu-devel@nongnu.org --- RFC because I need to enhance the libvirt testsuite to prove we set the option, and because the qemu side has not been committed yet (and may therefore change the final spelling for the new option). src/qemu/qemu_capabilities.c | 7 +++++-- src/qemu/qemu_capabilities.h | 3 ++- src/qemu/qemu_command.c | 3 +++ 3 files changed, 10 insertions(+), 3 deletions(-)