From patchwork Tue Mar 15 14:47:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Michael S. Tsirkin" X-Patchwork-Id: 8588931 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 9770AC0553 for ; Tue, 15 Mar 2016 14:47:45 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EBDDC200CF for ; Tue, 15 Mar 2016 14:47:44 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2F30A201C7 for ; Tue, 15 Mar 2016 14:47:43 +0000 (UTC) Received: from localhost ([::1]:48756 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1afqG6-0005fI-6R for patchwork-qemu-devel@patchwork.kernel.org; Tue, 15 Mar 2016 10:47:42 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53627) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1afqFp-0005Uj-Th for qemu-devel@nongnu.org; Tue, 15 Mar 2016 10:47:29 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1afqFm-0001k9-0F for qemu-devel@nongnu.org; Tue, 15 Mar 2016 10:47:25 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47352) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1afqFl-0001jD-R5 for qemu-devel@nongnu.org; Tue, 15 Mar 2016 10:47:21 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (Postfix) with ESMTPS id 6E17C64D0F for ; Tue, 15 Mar 2016 14:47:21 +0000 (UTC) Received: from redhat.com (vpn1-6-68.ams2.redhat.com [10.36.6.68]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with SMTP id u2FElIFT019661; Tue, 15 Mar 2016 10:47:19 -0400 Date: Tue, 15 Mar 2016 16:47:17 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1458053080-29170-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline X-Mutt-Fcc: =sent X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 15 Mar 2016 14:47:21 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Cc: Paolo Bonzini , Gerd Hoffmann Subject: [Qemu-devel] [PATCH v2] vl.c: disallow command line fw cfg without opt/ X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Allowing arbitary file names on command line is setting us up for failure: future guests will look for a specific QEMU-specified name and will get confused finding a user file there. We do warn but people are conditioned to ignore warnings by now, so at best that will help users debug problem, not avoid it. Disable this by default, so distros don't get to deal with it, but leave an option for developers to configure this in, with scary warnings so people only do it if they know what they are doing. Signed-off-by: Michael S. Tsirkin --- changes from v1: add configure option configure | 7 +++++++ vl.c | 3 +++ 2 files changed, 10 insertions(+) diff --git a/configure b/configure index 2b32876..e5a692f 100755 --- a/configure +++ b/configure @@ -256,6 +256,7 @@ sysconfdir="\${prefix}/etc" local_statedir="\${prefix}/var" confsuffix="/qemu" slirp="yes" +unsafe_fw_cfg="no" oss_lib="" bsd="no" linux="no" @@ -875,6 +876,8 @@ for opt do ;; --enable-vnc-png) vnc_png="yes" ;; + --enable-unsafe-fw-cfg) unsafe_fw_cfg="yes" + ;; --disable-slirp) slirp="no" ;; --disable-uuid) uuid="no" @@ -1286,6 +1289,7 @@ Advanced options (experts only): Available backends: $($python $source_path/scripts/tracetool.py --list-backends) --with-trace-file=NAME Full PATH,NAME of file to store traces Default:trace- + --enable-unsafe-fw-cfg Enable loading fw cfg entries at unsafe paths (broken! don't use in production!) --disable-slirp disable SLIRP userspace network connectivity --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI) --oss-lib path to OSS library @@ -4911,6 +4915,9 @@ fi if test "$profiler" = "yes" ; then echo "CONFIG_PROFILER=y" >> $config_host_mak fi +if test "$unsafe_fw_cfg" = "yes" ; then + echo "CONFIG_UNSAFE_FW_CFG=y" >> $config_host_mak +fi if test "$slirp" = "yes" ; then echo "CONFIG_SLIRP=y" >> $config_host_mak echo "CONFIG_SMBD_COMMAND=\"$smbd\"" >> $config_host_mak diff --git a/vl.c b/vl.c index 7a28982..5adf217 100644 --- a/vl.c +++ b/vl.c @@ -2321,6 +2321,9 @@ static int parse_fw_cfg(void *opaque, QemuOpts *opts, Error **errp) if (strncmp(name, "opt/", 4) != 0) { error_report("warning: externally provided fw_cfg item names " "should be prefixed with \"opt/\""); +#ifndef CONFIG_UNSAFE_FW_CFG + return -1; +#endif } if (nonempty_str(str)) { size = strlen(str); /* NUL terminator NOT included in fw_cfg blob */