Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Kevin Wolf]

Am 09.03.2020 um 16:44 hat Daniel P. Berrangé geschrieben:
> We could support "-F ..." and validate any non-raw formats, while raising a
> runtime error in the case of "-F raw", as only the "raw" backing format has
> the probing security risk.
> 
> Users who need  to use qcow, with a backing file, without a format can
> just not pass "-F" and in doing so will be insecure.

Hm, this is actually an interesting option. We wouldn't lose features
compared to today without -F, but we would allow -F when we can verify
that the operation is safe (the image is already non-raw).

> We could take this opportunity to deprecate 'qcow' perhaps, declare it
> a read-only format, restricted to qemu-img/qemu-io for purpose of data
> liberation ?

I'm against making any format read-only because that immediately means
that it becomes untestable.

> For sheepdog, if it is something we genuinely still care about, then
> adding a backing file format record seems neccessary, unless we either
> forbid use of raw backing files, or forbid use of non-raw backing files,
> either way would be safe.

In case of doubt, we can use the same logic as you suggested for qcow
(accept only non-raw with -F, but no restrictions without -F).

Kevin