f45b5f024e
This does two things: 1. It makes us check that the QCOW backing_file is unset on those types of images. Nova and Cinder do this already to prevent an arbitrary (and trivial to accomplish) host file exposure exploit. 2. It makes us restrict VMDK files to only allowed subtypes. These files can name arbitrary files on disk as extents, providing the same sort of attack. Default that list to just the types we believe are actually useful for openstack, and which are monolithic. The configuration option to specify allowed subtypes is added in glance's config and not in the import options so that we can extend this check later to image ingest. The format_inspector can tell us what the type and subtype is, and we could reject those images early and even in the case where image_conversion is not enabled. Closes-Bug: #1996188 Change-Id: Idf561f6306cebf756c787d8eefdc452ce44bd5e0 (cherry picked from commit 0d6282a01691cecc2798f7858b181c4bb30f850c) (cherry picked from commit 4967ab6935cfd0274ae801ac943d01909a236a0a) (cherry picked from commit dc8e5a5cc7f5e9d1b697e520a7533cc90516db1b)
OpenStack Glance
Glance is an OpenStack project that provides services and associated libraries to store, browse, share, distribute and manage bootable disk images, other data closely associated with initializing compute resources, and metadata definitions.
Use the following resources to learn more:
API
To learn how to use Glance's API, consult the documentation available online at:
Developers
For information on how to contribute to Glance, please see the contents of the CONTRIBUTING.rst in this repository.
Any new code must follow the development guidelines detailed in the HACKING.rst file, and pass all unit tests.
Further developer focused documentation is available at:
Operators
To learn how to deploy and configure OpenStack Glance, consult the documentation available online at:
In the unfortunate event that bugs are discovered, they should be reported to the appropriate bug tracker. You can raise bugs here:
Release notes
To learn more about Glance's new features, optimizations, and changes between versions, consult the release notes online at:
Other Information
During each design summit, we agree on what the whole community wants to focus on for the upcoming release. You can see image service plans:
For more information about the Glance project please see: