Sasha Levin <levinsasha...@gmail.com> writes: > On Thu, Nov 10, 2011 at 9:57 AM, Markus Armbruster <arm...@redhat.com> wrote: [...] >> Start with a clean read/write raw image. Probing declares it raw. >> Guest writes QCOW signature to it, with a backing file of its choice. >> >> Restart with the same image. Probing declares it QCOW2. Guest can read >> the backing file. Oops. > > Thats an excellent scenario why you'd want to have 'Secure KVM' with > seccomp filters :)
Yup. For what it's worth, sVirt (use SELinux to secure virtualization) mitigates the problem. Doesn't mean we couldn't use "Secure KVM". > I'm actually not sure why KVM tool got QCOW support in the first > place. You can have anything QCOW provides if you use btrfs (among > several other FSs). Maybe it's just me, but isn't it weird to have a filesystem (QCOW2) sitting in the kernel sources that you can't mount(2)? -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
