d9f059aa6c
Creating an image that requires format probing of the backing image is potentially unsafe (we've had several CVEs over the years based on probes leaking information to the guest on a subsequent boot, although these days tools like libvirt are aware of the issue enough to prevent the worst effects). For example, if our probing algorithm ever changes, or if other tools like libvirt determine a different probe result than we do, then subsequent use of that backing file under a different format will present corrupted data to the guest. Fortunately, the worst effects occur only when the backing image is originally raw, and we at least prevent commit into a probed raw backing file that would change its probed type. Still, it is worth starting a deprecation clock so that future qemu-img can refuse to create backing chains that would rely on probing, to encourage clients to avoid unsafe practices. Most warnings are intentionally emitted from bdrv_img_create() in the block layer, but qemu-img convert uses bdrv_create() which cannot emit its own warning without causing spurious warnings on other code paths. In the end, all command-line image creation or backing file rewriting now performs a check. Furthermore, if we probe a backing file as non-raw, then it is safe to explicitly record that result (rather than relying on future probes); only where we probe a raw image do we care about further warnings to the user when using such an image (for example, commits into a probed-raw backing file are prevented), to help them improve their tooling. But whether or not we make the probe results explicit, we still warn the user to remind them to upgrade their workflow to supply -F always. iotest 114 specifically wants to create an unsafe image for later amendment rather than defaulting to our new default of recording a probed format, so it needs an update. While touching it, expand it to cover all of the various warnings enabled by this patch. iotest 301 also shows a change to qcow messages. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20200706203954.341758-11-eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
60 lines
2.3 KiB
Plaintext
60 lines
2.3 KiB
Plaintext
QA output created by 301
|
|
|
|
== qcow backed by qcow ==
|
|
Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432
|
|
qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
|
|
image: TEST_DIR/t.IMGFMT
|
|
file format: IMGFMT
|
|
virtual size: 32 MiB (33554432 bytes)
|
|
cluster_size: 512
|
|
backing file: TEST_DIR/t.IMGFMT.base
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
|
|
image: TEST_DIR/t.IMGFMT
|
|
file format: IMGFMT
|
|
virtual size: 32 MiB (33554432 bytes)
|
|
cluster_size: 512
|
|
backing file: TEST_DIR/t.IMGFMT.base
|
|
|
|
== mismatched command line detection ==
|
|
qemu-img: TEST_DIR/t.IMGFMT: invalid VMDK image descriptor
|
|
Could not open backing image.
|
|
qemu-img: TEST_DIR/t.IMGFMT: invalid VMDK image descriptor
|
|
Could not open backing image.
|
|
|
|
qemu-img: TEST_DIR/t.IMGFMT: Image creation needs a size parameter
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=vmdk
|
|
|
|
qemu-img: TEST_DIR/t.IMGFMT: Unknown driver 'garbage'
|
|
Could not open backing image.
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=garbage
|
|
qemu-img: TEST_DIR/t.IMGFMT: unrecognized backing format 'garbage'
|
|
image: TEST_DIR/t.IMGFMT
|
|
file format: IMGFMT
|
|
virtual size: 32 MiB (33554432 bytes)
|
|
cluster_size: 512
|
|
backing file: TEST_DIR/t.IMGFMT.base
|
|
|
|
== qcow backed by raw ==
|
|
qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
|
|
image: TEST_DIR/t.IMGFMT
|
|
file format: IMGFMT
|
|
virtual size: 32 MiB (33554432 bytes)
|
|
cluster_size: 512
|
|
backing file: TEST_DIR/t.IMGFMT.base
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=raw
|
|
image: TEST_DIR/t.IMGFMT
|
|
file format: IMGFMT
|
|
virtual size: 32 MiB (33554432 bytes)
|
|
cluster_size: 512
|
|
backing file: TEST_DIR/t.IMGFMT.base
|
|
|
|
== commit cannot change type of raw backing file ==
|
|
Formatting 'TEST_DIR/t.qcow.IMGFMT', fmt=IMGFMT size=33554432
|
|
qemu-img: Block job failed: Operation not permitted
|
|
image: TEST_DIR/t.IMGFMT.base
|
|
file format: raw
|
|
virtual size: 32 MiB (33554432 bytes)
|
|
*** done
|