<div dir="ltr">Hi,<br><div class="gmail_extra"><div><div dir="ltr"><br></div></div><div class="gmail_quote">On Wed, Sep 11, 2013 at 1:06 PM, Gerry O'Brien <span dir="ltr"><<a href="mailto:gerry@scss.tcd.ie" target="_blank">gerry@scss.tcd.ie</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hi Carlos,<br>
<br>
I appreciate the security issues. I'm just wondering why /var/lib/one/datastores is not a safe directory by default given it is the default location for datastores?<br></blockquote><div><br></div><div>Oneadmin's home /var/lib/one is restricted by default, because it contains the one_auth file, the database one.db... And /var/lib/one/datastores must also be restricted, because a user should not be able to copy another registered image in there. I hope this makes sense.</div>
<div><br></div><div>Cheers</div><div><div dir="ltr">--<br>Join us at <a href="http://opennebulaconf.com/" target="_blank">OpenNebulaConf2013</a> in Berlin, 24-26 September, 2013<br>--<div>Carlos Martín, MSc<br>Project Engineer<br>
OpenNebula - The Open-source Solution for Data Center Virtualization<div><span style="border-collapse:collapse;color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><a href="http://www.opennebula.org/" target="_blank">www.OpenNebula.org</a> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> | <a href="http://twitter.com/opennebula" target="_blank">@OpenNebula</a></span><span style="border-collapse:collapse;color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><a href="mailto:cmartin@opennebula.org" target="_blank" style="color:rgb(42,93,176)"></a></span></div>
</div></div></div><div> </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Regards,<br>
Gerry<div class="im"><br>
<br>
<br>
On 11/09/2013 11:51, Carlos Martín Sánchez wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">
Hi,<br>
<br>
Tue Sep 10 14:32:48 2013 [ImM][E]: cp: Not allowed to copy images from<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
/var/lib/one/ /etc/one/ /var/lib/one/<br>
</blockquote>
<br>
The dir /var/lib/one is a restricted dir, and OpenNebula won't allow you to<br>
copy images from there. Otherwise, you could copy the DB or other<br>
authentication files. That's why it works from /datastores.<br>
<br>
See [1] for more information.<br>
<br>
Best regards.<br>
<br>
[1]<br>
<a href="http://opennebula.org/documentation:rel4.2:fs_ds#configuring_the_filesystem_datastores" target="_blank">http://opennebula.org/<u></u>documentation:rel4.2:fs_ds#<u></u>configuring_the_filesystem_<u></u>datastores</a><br>
<br>
<br>
--<br></div>
Join us at OpenNebulaConf2013 <<a href="http://opennebulaconf.com" target="_blank">http://opennebulaconf.com</a>> in Berlin, 24-26<div class="im"><br>
September, 2013<br>
--<br>
Carlos Martín, MSc<br>
Project Engineer<br>
OpenNebula - The Open-source Solution for Data Center Virtualization<br>
<a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> |<br></div>
@OpenNebula<<a href="http://twitter.com/opennebula" target="_blank">http://twitter.<u></u>com/opennebula</a>><<a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@<u></u>opennebula.org</a>><div class="im">
<br>
<br>
<br>
On Tue, Sep 10, 2013 at 4:59 PM, Gerry O'Brien <<a href="mailto:gerry@scss.tcd.ie" target="_blank">gerry@scss.tcd.ie</a>> wrote:<br>
<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">
Hi,<br>
<br>
This seems to be a general issue not specific to QCOW2. For the moment<br>
I've solved the issue by mounting the datastores (which are NFS exports for<br>
a filestore) on the root partition at /datastores and created a symlink<br>
form /var/lib/one/datatstore to /datastores.<br>
<br>
Is this correct?<br>
<br>
Gerry<br>
<br>
<br>
On 10/09/2013 14:38, Gerry O'Brien wrote:<br>
<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">
Hi,<br>
<br>
I get the following error when trying to create an image from a QCOW2<br>
file: "Error copying image in the datastore: Not allowed to copy image<br></div>
file /var/lib/one/datastores/1/**<u></u>DELETEME.qcow2"<div class="im"><br>
Below are the commands I use to create the QCOW2 file before trying<br>
to create the image named DELETEME using oneimage. The QCOW2 file is has<br>
been created with a backing file.<br>
<br>
This used to work in Opennebula 3. I have made sure the use oneadmin<br>
is also in the cloud group in case it is some kind of permissions file.<br>
<br>
Any ideas?<br>
<br>
Regards,<br>
Gerry<br>
<br>
<br>
<br></div>
qemu-img create -f qcow2 -o backing_file=/var/lib/one/**<u></u>datastores/1/**<br>
e1e1735dada84a7c6290001b9a244e<u></u>**be /var/lib/one/datastores/1/**<u></u>DELETEME.qcow2<br>
<br>
qemu-img info /var/lib/one/datastores/1/**<u></u>DELETEME.qcow2<br>
image: /var/lib/one/datastores/1/**<u></u>DELETEME.qcow2<div class="im"><br>
file format: qcow2<br>
virtual size: 50G (53687091200 bytes)<br>
disk size: 12K<br>
cluster_size: 65536<br></div>
backing file: /var/lib/one/datastores/1/**<u></u>e1e1735dada84a7c6290001b9a244e<u></u>*<br>
*be<br>
<br>
<br>
<br>
ls -la /var/lib/one/datastores/1/**<u></u>DELETEME.qcow2<div class="im"><br>
-rw-r--r-- 1 oneadmin oneadmin 197632 Sep 10 13:27<br></div>
/var/lib/one/datastores/1/**<u></u>DELETEME.qcow2<div class="im"><br>
<br>
oneimage create -d default --name DELETEME --path<br></div>
/var/lib/one/datastores/1/**<u></u>DELETEME.qcow2 --prefix hd --type OS<div class="im"><br>
--driver qcow2 --persistent<br>
<br>
<br>
<br>
<br>
<br>
<br>
Below is a similar error message when using the sunstone GUI<br>
<br>
<br></div>
Tue Sep 10 14:32:48 2013 [ImM][I]: Copying /var/lib/one/datastores/1/**<u></u>VlabC_1.qcow2<div class="im"><br>
to repository for image 37<br>
Tue Sep 10 14:32:48 2013 [ReM][D]: Req:7232 UID:0 ImageAllocate result<br>
SUCCESS, 37<br>
Tue Sep 10 14:32:48 2013 [ReM][D]: Req:4064 UID:0 ImageInfo invoked, 37<br>
Tue Sep 10 14:32:48 2013 [ReM][D]: Req:4064 UID:0 ImageInfo result<br>
SUCCESS, "<IMAGE><ID>37</ID><U..."<br>
Tue Sep 10 14:32:48 2013 [ImM][I]: Command execution fail:<br></div>
/var/lib/one/remotes/**<u></u>datastore/fs/cp PERTX0RSSVZFUl9BQ1RJT05fREFUQT<u></u>**<br>
48SU1BR0U+**<u></u>PElEPjM3PC9JRD48VUlEPjA8L1VJRD<u></u>**48R0lEPjA8L0dJRD48VU5BTUU+**<br>
b25lYWRtaW48L1VOQU1FPjxHTkFNRT<u></u>**5vbmVhZG1pbjwvR05BTUU+<u></u>PE5BTUU+**<br>
UUNPVzItRXhhbXBsZTwvTkFNRT48UE<u></u>**VSTUlTU0lPTlM+PE9XTkVSX1U+**<br>
MTwvT1dORVJfVT48T1dORVJfTT4xPC<u></u>**<u></u>9PV05FUl9NPjxPV05FUl9BPjA8L09X<u></u>**<br>
TkVSX0E+PEdST1VQX1U+**<u></u>MDwvR1JPVVBfVT48R1JPVVBfTT4wPC<u></u>**<br>
9HUk9VUF9NPjxHUk9VUF9BPjA8L0dS<u></u>**T1VQX0E+PE9USEVSX1U+**<br>
MDwvT1RIRVJfVT48T1RIRVJfTT4wPC<u></u>**<u></u>9PVEhFUl9NPjxPVEhFUl9BPjA8L09U<u></u>**SEVSX0E+*<br>
*<u></u>PC9QRVJNSVNTSU9OUz48VFlQRT4yPC<u></u>**9UWVBFPjxESVNLX1RZUEU+**<br>
MDwvRElTS19UWVBFPjxQRVJTSVNURU<u></u>**5UPjE8L1BFUlNJU1RFTlQ+**<u></u>PFJFR1RJTUU+**<br>
MTM3ODgxOTk2ODwvUkVHVElNRT48U0<u></u>**<u></u>9VUkNFPjwvU09VUkNFPjxQQVRIPi92<u></u>**<br>
YXIvbGliL29uZS9kYXRhc3RvcmVzLz<u></u>**<u></u>EvVmxhYkNfMS5xY293MjwvUEFUSD48<u></u>**<br>
RlNUWVBFPjwvRlNUWVBFPjxTSVpFPj<u></u>**E8L1NJWkU+**<br>
PFNUQVRFPjQ8L1NUQVRFPjxSVU5OSU<u></u>**<u></u>5HX1ZNUz4wPC9SVU5OSU5HX1ZNUz48<u></u>**<br>
Q0xPTklOR19PUFM+**<u></u>MDwvQ0xPTklOR19PUFM+**<u></u>PENMT05JTkdfSUQ+**<br>
LTE8L0NMT05JTkdfSUQ+**<u></u>PERBVEFTVE9SRV9JRD4xPC9EQVRBU1<u></u>**RPUkVfSUQ+**<br>
PERBVEFTVE9SRT5kZWZhdWx0PC9EQV<u></u>**RBU1RPUkU+**<br>
PFZNUz48L1ZNUz48Q0xPTkVTPjwvQ0<u></u>**<u></u>xPTkVTPjxURU1QTEFURT48REVWX1BS<br>
<br>
</blockquote>
RU<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
ZJWD48IVtDREFUQVtoZF1dPjwvREVW<u></u>**<u></u>X1BSRUZJWD48RFJJVkVSPjwhW0NEQV<u></u>**<br>
RBW3Fjb3cyXV0+PC9EUklWRVI+**<u></u>PC9URU1QTEFURT48L0lNQUdFPjxEQV<u></u>**<br>
RBU1RPUkU+PElEPjE8L0lEPjxVSUQ+<u></u>**MDwvVUlEPjxHSUQ+**<br>
MDwvR0lEPjxVTkFNRT5vbmVhZG1pbj<u></u>**wvVU5BTUU+**<br>
PEdOQU1FPm9uZWFkbWluPC9HTkFNRT<u></u>**<u></u>48TkFNRT5kZWZhdWx0PC9OQU1FPjxQ<u></u>**<br>
RVJNSVNTSU9OUz48T1dORVJfVT4xPC<u></u>**<u></u>9PV05FUl9VPjxPV05FUl9NPjE8L09X<u></u>**<br>
TkVSX00+PE9XTkVSX0E+**<u></u>MDwvT1dORVJfQT48R1JPVVBfVT4xPC<u></u>**<br>
9HUk9VUF9VPjxHUk9VUF9NPjA8L0dS<u></u>**T1VQX00+PEdST1VQX0E+**<br>
MDwvR1JPVVBfQT48T1RIRVJfVT4xPC<u></u>**<u></u>9PVEhFUl9VPjxPVEhFUl9NPjA8L09U<u></u>**<br>
SEVSX00+PE9USEVSX0E+**<u></u>MDwvT1RIRVJfQT48L1BFUk1JU1NJT0<u></u>**5TPjxEU19NQUQ+**<br>
ZnM8L0RTX01BRD48VE1fTUFEPnNoYX<u></u>**<u></u>JlZDwvVE1fTUFEPjxCQVNFX1BBVEg+<u></u>**<br>
L3Zhci9saWIvb25lL2RhdGFzdG9yZX<u></u>**<u></u>MvMTwvQkFTRV9QQVRIPjxUWVBFPjA8<u></u>**L1RZUEU+*<br>
*<u></u>PERJU0tfVFlQRT4wPC9ESVNLX1RZUE<u></u>**U+PENMVVNURVJfSUQ+**<u></u>LTE8L0NMVVNURVJfSUQ+<br>
**PENMVVNURVI+**<u></u>PC9DTFVTVEVSPjxUT1RBTF9NQj4yMj<u></u>**QwNzIzNjwvVE9UQUxfTUI+**<br>
PEZSRUVfTUI+**<u></u>MjIzNjQ1MzI8L0ZSRUVfTUI+**<u></u>PFVTRURfTUI+**<br>
NDI3MDc8L1VTRURfTUI+**<u></u>PElNQUdFUz48SUQ+MDwvSUQ+**<br>
PElEPjE8L0lEPjxJRD4yPC9JRD48SU<u></u>**Q+MzwvSUQ+**<u></u>PElEPjQ8L0lEPjxJRD4xNjwvSUQ+*<br>
*PElEPjIwPC9JRD48L0lNQU<br>
<br>
</blockquote>
d<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
FUz48VEVNUExBVEU+**<u></u>PERTX01BRD48IVtDREFUQVtmc11dPj<u></u>**wvRFNfTUFEPjxUTV9NQUQ+<br>
**PCFbQ0RBVEFbc2hhcmVkXV0+**<u></u>PC9UTV9NQUQ+PFRZUEU+**<br>
PCFbQ0RBVEFbSU1BR0VfRFNdXT48L1<u></u>**RZUEU+**<u></u>PC9URU1QTEFURT48L0RBVEFTVE9SRT<u></u>**<br>
48L0RTX0RSSVZFUl9BQ1RJT05fREFU<u></u>**QT4= 37<div class="im"><br>
Tue Sep 10 14:32:48 2013 [ImM][E]: cp: Not allowed to copy images from<br>
/var/lib/one/ /etc/one/ /var/lib/one/<br>
Tue Sep 10 14:32:48 2013 [ImM][E]: Not allowed to copy image file<br></div>
/var/lib/one/datastores/1/**<u></u>VlabC_1.qcow2<div class="im"><br>
Tue Sep 10 14:32:48 2013 [ImM][I]: ExitCode: 255<br>
Tue Sep 10 14:32:48 2013 [ImM][E]: Error copying image in the datastore:<br></div>
Not allowed to copy image file /var/lib/one/datastores/1/**<u></u>VlabC_1.qcow2<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</blockquote><div class="im">
--<br>
Gerry O'Brien<br>
<br>
Systems Manager<br>
School of Computer Science and Statistics<br>
Trinity College Dublin<br>
Dublin 2<br>
IRELAND<br>
<br>
00 353 1 896 1341<br>
<br>
<br></div>
______________________________<u></u>**_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/**listinfo.cgi/users-opennebula.**org" target="_blank">http://lists.opennebula.org/**<u></u>listinfo.cgi/users-opennebula.<u></u>**org</a><<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.<u></u>org/listinfo.cgi/users-<u></u>opennebula.org</a>><br>
<br>
</blockquote></blockquote><div class=""><div class="h5">
<br>
<br>
-- <br>
Gerry O'Brien<br>
<br>
Systems Manager<br>
School of Computer Science and Statistics<br>
Trinity College Dublin<br>
Dublin 2<br>
IRELAND<br>
<br>
00 353 1 896 1341<br>
<br>
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/<u></u>listinfo.cgi/users-opennebula.<u></u>org</a><br>
</div></div></blockquote></div><br></div></div>