Re: [PATCH v4 7/7] qemu-img: Deprecate use of -b without -F

[Eric Blake]

On 3/12/20 2:28 PM, Eric Blake wrote:
> Creating an image that requires format probing of the backing image is
> inherently unsafe (we've had several CVEs over the years based on
> probes leaking information to the guest on a subsequent boot, although
> these days tools like libvirt are aware of the issue enough to prevent
> the worst effects).  However, if our probing algorithm ever changes,
> or if other tools like libvirt determine a different probe result than
> we do, then subsequent use of that backing file under a different
> format will present corrupted data to the guest.  Start a deprecation
> clock so that future qemu-img can refuse to create unsafe backing
> chains that would rely on probing.  The warnings are intentionally
> emitted from the block layer rather than qemu-img (thus, all paths
> into image creation or rewriting perform the check).
>
> However, there is one time where probing is safe: if we probe raw,
> then it is safe to record that implicitly in the image (but we still
> warn, as it's better to teach the user to supply -F always than to
> make them guess when it is safe).
>
> iotest 114 specifically wants to create an unsafe image for later
> amendment rather than defaulting to our new default of recording a
> probed format, so it needs an update.  While touching it, expand it to
> cover all of the various warnings enabled by this patch.  iotest 290
> also shows a change to qcow messages; note that the fact that we now
> make a probed format of 'raw' explicit now results in a double
> warning, but no one should be creating new qcow images so it is not
> worth cleaning up.
>
> Signed-off-by: Eric Blake <address@hidden>
> ---
>   docs/system/deprecated.rst | 19 +++++++++++++++++++

Squash this in per Kashyap's v3 review comments:

diff --git i/docs/system/deprecated.rst w/docs/system/deprecated.rst
index b541d52c7dc0..54a50c45e190 100644
--- i/docs/system/deprecated.rst
+++ w/docs/system/deprecated.rst
@@ -388,18 +388,19 @@ qemu-img backing file without format (since 5.0.0)
 The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
 convert`` to create or modify an image that depends on a backing file
 now recommends that an explicit backing format be provided.  This is
-for safety: if qemu probes a different format than what you thought,
+for safety: if QEMU probes a different format than what you thought,
 the data presented to the guest will be corrupt; similarly, presenting
 a raw image to a guest allows a potential security exploit if a future
-probe sees a non-raw image based on guest writes.  To avoid the
-warning message, or even future refusal to create an unsafe image, you
-must pass ``-o backing_fmt=`` (or the shorthand ``-F`` during create)
-to specify the intended backing format.  You may use ``qemu-img rebase
--u`` to retroactively add a backing format to an existing image.
-However, be aware that there are already potential security risks to
-blindly using ``qemu-img info`` to probe the format of an untrusted
-backing image, when deciding what format to add into an existing
-image.
+probe sees a non-raw image based on guest writes.
+
+To avoid the warning message, or even future refusal to create an
+unsafe image, you must pass ``-o backing_fmt=`` (or the shorthand
+``-F`` during create) to specify the intended backing format.  You may
+use ``qemu-img rebase -u`` to retroactively add a backing format to an
+existing image.  However, be aware that there are already potential
+security risks to blindly using ``qemu-img info`` to probe the format
+of an untrusted backing image, when deciding what format to add into
+an existing image.

 ``qemu-img convert -n -o`` (since 4.2.0)
 ''''''''''''''''''''''''''''''''''''''''

--
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org