Re: [Qemu-devel] Image probing: how it can be insecure, and what we could do about it

[Gerd Hoffmann]

  Hi,

> My proposal to ditch image contents probing entirely has more serious
> compatibility issues.  In particular, we'd have to forgo sugared
> convenience syntax for a number of less common things.  It definitely
> needs a grace period where all usage we're going to break warns.  On the
> up side, it will actually be secure by default when it's done.

This makes most sense to me.  We can even have a config option to
control this, i.e. something like ...

-guessformat={allow-content,allow-content-with-warning,filename-only,off}

... and over time we'll make things more strict by default.

People can tweak things locally via cfg file in /etc/qemu if they wish.

cheers,
  Gerd