[PATCH v5 7/7] qemu-img: Deprecate use of -b without -F

[Peter Krempa]

On Tue, May 05, 2020 at 10:11:03 +0200, Kevin Wolf wrote:
> Am 03.04.2020 um 19:58 hat Eric Blake geschrieben:
> > Creating an image that requires format probing of the backing image is
> > inherently unsafe (we've had several CVEs over the years based on
> > probes leaking information to the guest on a subsequent boot, although
> > these days tools like libvirt are aware of the issue enough to prevent
> > the worst effects).  However, if our probing algorithm ever changes,
> > or if other tools like libvirt determine a different probe result than
> > we do, then subsequent use of that backing file under a different
> > format will present corrupted data to the guest.  Start a deprecation
> > clock so that future qemu-img can refuse to create unsafe backing
> > chains that would rely on probing.  Most warnings are intentionally
> > emitted from bdrv_img_create() in the block layer, but qemu-img
> > convert uses bdrv_create() which cannot emit its own warning without
> > causing spurious warnings on other code paths.  In the end, all
> > command-line image creation or backing file rewriting now performs a
> > check.
> > 
> > However, there is one time where probing is safe: if we probe raw,
> > then it is safe to record that implicitly in the image (but we still
> > warn, as it's better to teach the user to supply -F always than to
> > make them guess when it is safe).
> 
> You're not stating it explicitly, but I guess the thing that you mean
> that is actually unsafe is if you have a raw image, always pass
> format=raw to QEMU (so the guest could write e.g. a qcow2 header), but
> then create a backing file without -F, so it will be probed. This is as
> bad as specifying format=raw only sometimes.
> 
> I don't like the idea of responding to this by making raw images more
> convenient to use than actual image formats.
> 
> How about we approach it the other way around: The troublemaker is raw,
> so let's require specifying raw explicitly, and record the probed format
> implicitly in other cases. This is a bit weaker in the immediate effect
> in that it doesn't protect you when you actually deal with a malicious
> image, but in normal use it will point out where your scripts or
> management software is too careless. The final result should be that
> management tools are fixed and you'll be safe, while manual users who
> can usually trust their guests aren't inconvenienced too much.

That is definitely better than just probing. In my opinion though the
format should always be specified explicitly. No favorism of 'raw' or
any other format. In libvirt we fill-in that the format of the image is
'raw' unless the user specifies something else rather than reporting an
error. This causes continuous grief for users who forget to set the
format. (one example is that if you create a fully-allocated qcow2 image
but use it as raw and install your VM, you'll never notice until you
want to use qcow2 features. Users usually notice once they try to create
a sparse image though due to the size difference)