From eabb16a421326388c8d53a1b6ca47d79a03e0e16 Mon Sep 17 00:00:00 2001 From: Dan Smith Date: Thu, 10 Nov 2022 09:55:48 -0800 Subject: [stable-only][cve] Check VMDK create-type against an allowed list NOTE(sbauza): Stable policy allows us to proactively merge a backport without waiting for the parent patch to be merged (exception to rule #4 in [1]. Marking [stable-only] in order to silence nova-tox-validate-backport [1] https://docs.openstack.org/project-team-guide/stable-branches.html#appropriate-fixes Conflicts vs wallaby in: nova/conf/compute.py nova/tests/unit/virt/test_images.py Related-Bug: #1996188 Change-Id: I5a399f1d3d702bfb76c067893e9c924904c8c360 --- nova/conf/compute.py | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'nova/conf/compute.py') diff --git a/nova/conf/compute.py b/nova/conf/compute.py index 92b5ab7918..cdd282a862 100644 --- a/nova/conf/compute.py +++ b/nova/conf/compute.py @@ -985,6 +985,15 @@ Additional documentation is available here: https://docs.openstack.org/nova/latest/admin/managing-resource-providers.html +"""), + cfg.ListOpt('vmdk_allowed_types', + default=['streamOptimized', 'monolithicSparse'], + help=""" +A list of strings describing allowed VMDK "create-type" subformats +that will be allowed. This is recommended to only include +single-file-with-sparse-header variants to avoid potential host file +exposure due to processing named extents. If this list is empty, then no +form of VMDK image will be allowed. """), ] -- cgit v1.2.1