<div dir="ltr">Well, yes. If I register a new image with the path /datastores/0/<vmid>/deployment.0 I could get your vnc password, for example. Or if I point it to the context cdrom image, I could get some variables that may contain important information. And, of course, I could copy one of your images or running VM disks.<div>
<br></div><div>Cheers<br><div><br></div></div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr">--<br>Join us at <a href="http://opennebulaconf.com" target="_blank">OpenNebulaConf2013</a> in Berlin, 24-26 September, 2013<br>
--<div>Carlos Martín, MSc<br>Project Engineer<br>OpenNebula - The Open-source Solution for Data Center Virtualization<div><span style="border-collapse:collapse;color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> | <a href="http://twitter.com/opennebula" target="_blank">@OpenNebula</a></span><span style="border-collapse:collapse;color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><a href="mailto:cmartin@opennebula.org" style="color:rgb(42,93,176)" target="_blank"></a></span></div>
</div></div></div>
<br><br><div class="gmail_quote">On Wed, Sep 11, 2013 at 2:05 PM, Gerry O'Brien <span dir="ltr"><<a href="mailto:gerry@scss.tcd.ie" target="_blank">gerry@scss.tcd.ie</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
By using /datastores instead of /var/lib/one/datastores, have I opened a security hole?<div class="im"><br>
<br>
<br>
On 11/09/2013 12:51, Carlos Martín Sánchez wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br><div class="im">
On Wed, Sep 11, 2013 at 1:06 PM, Gerry O'Brien <<a href="mailto:gerry@scss.tcd.ie" target="_blank">gerry@scss.tcd.ie</a>> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Carlos,<br>
<br>
I appreciate the security issues. I'm just wondering why<br>
/var/lib/one/datastores is not a safe directory by default given it is the<br>
default location for datastores?<br>
<br>
</blockquote>
Oneadmin's home /var/lib/one is restricted by default, because it contains<br>
the one_auth file, the database one.db... And /var/lib/one/datastores must<br>
also be restricted, because a user should not be able to copy another<br>
registered image in there. I hope this makes sense.<br>
<br>
Cheers<br>
--<br></div>
Join us at OpenNebulaConf2013 <<a href="http://opennebulaconf.com/" target="_blank">http://opennebulaconf.com/</a>> in Berlin, 24-26<div class="im"><br>
September, 2013<br>
--<br>
Carlos Martín, MSc<br>
Project Engineer<br>
OpenNebula - The Open-source Solution for Data Center Virtualization<br>
</div><a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> <<a href="http://www.opennebula.org/" target="_blank">http://www.opennebula.org/</a>> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> |<br>
@OpenNebula <<a href="http://twitter.com/opennebula" target="_blank">http://twitter.com/opennebula</a><u></u>> <<a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a>><br>
<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
Regards,<br>
Gerry<br>
<br>
<br>
<br>
On 11/09/2013 11:51, Carlos Martín Sánchez wrote:<br>
<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
Hi,<br>
<br>
Tue Sep 10 14:32:48 2013 [ImM][E]: cp: Not allowed to copy images from<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
/var/lib/one/ /etc/one/ /var/lib/one/<br>
<br>
</blockquote>
The dir /var/lib/one is a restricted dir, and OpenNebula won't allow you<br>
to<br>
copy images from there. Otherwise, you could copy the DB or other<br>
authentication files. That's why it works from /datastores.<br>
<br>
See [1] for more information.<br>
<br>
Best regards.<br>
<br>
[1]<br>
</div><a href="http://opennebula.org/**documentation:rel4.2:fs_ds#**" target="_blank">http://opennebula.org/**<u></u>documentation:rel4.2:fs_ds#**</a><br>
configuring_the_filesystem_**<u></u>datastores<<a href="http://opennebula.org/documentation:rel4.2:fs_ds#configuring_the_filesystem_datastores" target="_blank">http://opennebula.<u></u>org/documentation:rel4.2:fs_<u></u>ds#configuring_the_filesystem_<u></u>datastores</a>><div class="im">
<br>
<br>
<br>
--<br>
Join us at OpenNebulaConf2013 <<a href="http://opennebulaconf.com" target="_blank">http://opennebulaconf.com</a>> in Berlin,<br>
24-26<br>
<br>
September, 2013<br>
--<br>
Carlos Martín, MSc<br>
Project Engineer<br>
OpenNebula - The Open-source Solution for Data Center Virtualization<br>
<a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> |<br></div>
@OpenNebula<<a href="http://twitter." target="_blank">http://twitter.</a>**<u></u>com/opennebula<<a href="http://twitter.com/opennebula" target="_blank">http://twitter.<u></u>com/opennebula</a>><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<cmartin@**<a href="http://opennebula.org" target="_blank">opennebula.org</a> <<a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a>>><br>
</blockquote><div class="im">
<br>
<br>
On Tue, Sep 10, 2013 at 4:59 PM, Gerry O'Brien <<a href="mailto:gerry@scss.tcd.ie" target="_blank">gerry@scss.tcd.ie</a>> wrote:<br>
<br>
Hi,<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
This seems to be a general issue not specific to QCOW2. For the<br>
moment<br>
I've solved the issue by mounting the datastores (which are NFS exports<br>
for<br>
a filestore) on the root partition at /datastores and created a symlink<br>
form /var/lib/one/datatstore to /datastores.<br>
<br>
Is this correct?<br>
<br>
Gerry<br>
<br>
<br>
On 10/09/2013 14:38, Gerry O'Brien wrote:<br>
<br>
Hi,<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
I get the following error when trying to create an image from a<br>
QCOW2<br>
file: "Error copying image in the datastore: Not allowed to copy<br>
image<br></div>
file /var/lib/one/datastores/1/****<u></u>DELETEME.qcow2"<div class="im"><br>
<br>
Below are the commands I use to create the QCOW2 file before trying<br>
to create the image named DELETEME using oneimage. The QCOW2 file is has<br>
been created with a backing file.<br>
<br>
This used to work in Opennebula 3. I have made sure the use<br>
oneadmin<br>
is also in the cloud group in case it is some kind of permissions file.<br>
<br>
Any ideas?<br>
<br>
Regards,<br>
Gerry<br>
<br>
<br>
<br></div>
qemu-img create -f qcow2 -o backing_file=/var/lib/one/****<br>
datastores/1/**<br>
e1e1735dada84a7c6290001b9a244e<u></u>****be /var/lib/one/datastores/1/****<br>
DELETEME.qcow2<br>
<br>
qemu-img info /var/lib/one/datastores/1/****<u></u>DELETEME.qcow2<br>
image: /var/lib/one/datastores/1/****<u></u>DELETEME.qcow2<div class="im"><br>
<br>
file format: qcow2<br>
virtual size: 50G (53687091200 bytes)<br>
disk size: 12K<br>
cluster_size: 65536<br></div>
backing file: /var/lib/one/datastores/1/****<br>
e1e1735dada84a7c6290001b9a244e<u></u>***<br>
*be<br>
<br>
<br>
<br>
ls -la /var/lib/one/datastores/1/****<u></u>DELETEME.qcow2<div class="im"><br>
<br>
-rw-r--r-- 1 oneadmin oneadmin 197632 Sep 10 13:27<br></div>
/var/lib/one/datastores/1/****<u></u>DELETEME.qcow2<div class="im"><br>
<br>
<br>
oneimage create -d default --name DELETEME --path<br></div>
/var/lib/one/datastores/1/****<u></u>DELETEME.qcow2 --prefix hd --type OS<div class="im"><br>
<br>
--driver qcow2 --persistent<br>
<br>
<br>
<br>
<br>
<br>
<br>
Below is a similar error message when using the sunstone GUI<br>
<br>
<br>
Tue Sep 10 14:32:48 2013 [ImM][I]: Copying /var/lib/one/datastores/1/**<br>
**VlabC_1.qcow2<br>
<br>
to repository for image 37<br>
Tue Sep 10 14:32:48 2013 [ReM][D]: Req:7232 UID:0 ImageAllocate result<br>
SUCCESS, 37<br>
Tue Sep 10 14:32:48 2013 [ReM][D]: Req:4064 UID:0 ImageInfo invoked, 37<br>
Tue Sep 10 14:32:48 2013 [ReM][D]: Req:4064 UID:0 ImageInfo result<br>
SUCCESS, "<IMAGE><ID>37</ID><U..."<br>
Tue Sep 10 14:32:48 2013 [ImM][I]: Command execution fail:<br></div>
/var/lib/one/remotes/****<u></u>datastore/fs/cp PERTX0RSSVZFUl9BQ1RJT05fREFUQT<br>
****<br>
48SU1BR0U+****<u></u>PElEPjM3PC9JRD48VUlEPjA8L1VJRD<u></u>**<br>
**48R0lEPjA8L0dJRD48VU5BTUU+**<br>
b25lYWRtaW48L1VOQU1FPjxHTkFNRT<u></u>****5vbmVhZG1pbjwvR05BTUU+**<u></u>PE5BTUU+**<br>
UUNPVzItRXhhbXBsZTwvTkFNRT48UE<u></u>****VSTUlTU0lPTlM+PE9XTkVSX1U+<u></u>**<br>
MTwvT1dORVJfVT48T1dORVJfTT4xPC<u></u>******<u></u>9PV05FUl9NPjxPV05FUl9BPjA8L09X<u></u>****<br>
TkVSX0E+PEdST1VQX1U+****<u></u>MDwvR1JPVVBfVT48R1JPVVBfTT4wPC<u></u>****<br>
9HUk9VUF9NPjxHUk9VUF9BPjA8L0dS<u></u>****T1VQX0E+PE9USEVSX1U+**<br>
MDwvT1RIRVJfVT48T1RIRVJfTT4wPC<u></u>******<u></u>9PVEhFUl9NPjxPVEhFUl9BPjA8L09U<u></u>**<br>
**SEVSX0E+*<br>
***<u></u>PC9QRVJNSVNTSU9OUz48VFlQRT4yPC<u></u>****9UWVBFPjxESVNLX1RZUEU+**<br>
MDwvRElTS19UWVBFPjxQRVJTSVNURU<u></u>****5UPjE8L1BFUlNJU1RFTlQ+****<br>
PFJFR1RJTUU+**<br>
MTM3ODgxOTk2ODwvUkVHVElNRT48U0<u></u>******<u></u>9VUkNFPjwvU09VUkNFPjxQQVRIPi92<u></u>****<br>
YXIvbGliL29uZS9kYXRhc3RvcmVzLz<u></u>******<u></u>EvVmxhYkNfMS5xY293MjwvUEFUSD48<u></u>****<br>
RlNUWVBFPjwvRlNUWVBFPjxTSVpFPj<u></u>****E8L1NJWkU+**<br>
PFNUQVRFPjQ8L1NUQVRFPjxSVU5OSU<u></u>******<u></u>5HX1ZNUz4wPC9SVU5OSU5HX1ZNUz48<u></u>****<br>
Q0xPTklOR19PUFM+****<u></u>MDwvQ0xPTklOR19PUFM+****<u></u>PENMT05JTkdfSUQ+**<br>
LTE8L0NMT05JTkdfSUQ+****<u></u>PERBVEFTVE9SRV9JRD4xPC9EQVRBU1<u></u>****RPUkVfSUQ+**<br>
PERBVEFTVE9SRT5kZWZhdWx0PC9EQV<u></u>****RBU1RPUkU+**<br>
PFZNUz48L1ZNUz48Q0xPTkVTPjwvQ0<u></u>******<u></u>xPTkVTPjxURU1QTEFURT48REVWX1BS<br>
<br>
RU<br>
</blockquote>
ZJWD48IVtDREFUQVtoZF1dPjwvREVW<u></u>******<u></u>X1BSRUZJWD48RFJJVkVSPjwhW0NEQV<u></u>****<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
RBW3Fjb3cyXV0+PC9EUklWRVI+****<u></u>PC9URU1QTEFURT48L0lNQUdFPjxEQV<u></u>****<br>
RBU1RPUkU+PElEPjE8L0lEPjxVSUQ+<u></u>****MDwvVUlEPjxHSUQ+**<br>
MDwvR0lEPjxVTkFNRT5vbmVhZG1pbj<u></u>****wvVU5BTUU+**<br>
PEdOQU1FPm9uZWFkbWluPC9HTkFNRT<u></u>******<u></u>48TkFNRT5kZWZhdWx0PC9OQU1FPjxQ<u></u>****<br>
RVJNSVNTSU9OUz48T1dORVJfVT4xPC<u></u>******<u></u>9PV05FUl9VPjxPV05FUl9NPjE8L09X<u></u>****<br>
TkVSX00+PE9XTkVSX0E+****<u></u>MDwvT1dORVJfQT48R1JPVVBfVT4xPC<u></u>****<br>
9HUk9VUF9VPjxHUk9VUF9NPjA8L0dS<u></u>****T1VQX00+PEdST1VQX0E+**<br>
MDwvR1JPVVBfQT48T1RIRVJfVT4xPC<u></u>******<u></u>9PVEhFUl9VPjxPVEhFUl9NPjA8L09U<u></u>****<br>
SEVSX00+PE9USEVSX0E+****<u></u>MDwvT1RIRVJfQT48L1BFUk1JU1NJT0<u></u>**<br>
**5TPjxEU19NQUQ+**<br>
ZnM8L0RTX01BRD48VE1fTUFEPnNoYX<u></u>******<u></u>JlZDwvVE1fTUFEPjxCQVNFX1BBVEg+<u></u>****<br>
L3Zhci9saWIvb25lL2RhdGFzdG9yZX<u></u>******<u></u>MvMTwvQkFTRV9QQVRIPjxUWVBFPjA8<u></u>**<br>
**L1RZUEU+*<br>
***<u></u>PERJU0tfVFlQRT4wPC9ESVNLX1RZUE<u></u>****U+PENMVVNURVJfSUQ+****<br>
LTE8L0NMVVNURVJfSUQ+<br>
**PENMVVNURVI+****<u></u>PC9DTFVTVEVSPjxUT1RBTF9NQj4yMj<u></u>**<br>
**QwNzIzNjwvVE9UQUxfTUI+**<br>
PEZSRUVfTUI+****<u></u>MjIzNjQ1MzI8L0ZSRUVfTUI+****<u></u>PFVTRURfTUI+**<br>
NDI3MDc8L1VTRURfTUI+****<u></u>PElNQUdFUz48SUQ+MDwvSUQ+**<br>
PElEPjE8L0lEPjxJRD4yPC9JRD48SU<u></u>****Q+MzwvSUQ+****<br>
PElEPjQ8L0lEPjxJRD4xNjwvSUQ+*<br>
*PElEPjIwPC9JRD48L0lNQU<br>
<br>
d<br>
</blockquote>
FUz48VEVNUExBVEU+****<u></u>PERTX01BRD48IVtDREFUQVtmc11dPj<u></u>**<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
**wvRFNfTUFEPjxUTV9NQUQ+<br>
**PCFbQ0RBVEFbc2hhcmVkXV0+****<u></u>PC9UTV9NQUQ+PFRZUEU+**<br>
PCFbQ0RBVEFbSU1BR0VfRFNdXT48L1<u></u>****RZUEU+****<br>
PC9URU1QTEFURT48L0RBVEFTVE9SRT<u></u>****<br>
48L0RTX0RSSVZFUl9BQ1RJT05fREFU<u></u>****QT4= 37<div class="im"><br>
<br>
Tue Sep 10 14:32:48 2013 [ImM][E]: cp: Not allowed to copy images from<br>
/var/lib/one/ /etc/one/ /var/lib/one/<br>
Tue Sep 10 14:32:48 2013 [ImM][E]: Not allowed to copy image file<br></div>
/var/lib/one/datastores/1/****<u></u>VlabC_1.qcow2<div class="im"><br>
<br>
Tue Sep 10 14:32:48 2013 [ImM][I]: ExitCode: 255<br>
Tue Sep 10 14:32:48 2013 [ImM][E]: Error copying image in the datastore:<br></div>
Not allowed to copy image file /var/lib/one/datastores/1/****<br>
VlabC_1.qcow2<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
--<br>
</blockquote><div class="im">
Gerry O'Brien<br>
<br>
Systems Manager<br>
School of Computer Science and Statistics<br>
Trinity College Dublin<br>
Dublin 2<br>
IRELAND<br>
<br>
00 353 1 896 1341<br>
<br>
<br></div>
______________________________<u></u>****_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/****listinfo.cgi/users-opennebula.****org" target="_blank">http://lists.opennebula.org/**<u></u>**listinfo.cgi/users-<u></u>opennebula.****org</a><<a href="http://lists.opennebula.org/**listinfo.cgi/users-opennebula.**org" target="_blank">http://<u></u>lists.opennebula.org/**<u></u>listinfo.cgi/users-opennebula.<u></u>**org</a>><br>
<<a href="http://lists.opennebula." target="_blank">http://lists.opennebula.</a>**<u></u>org/listinfo.cgi/users-**<a href="http://opennebula.org" target="_blank">openn<u></u>ebula.org</a><<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.<u></u>opennebula.org/listinfo.cgi/<u></u>users-opennebula.org</a>><br>
<br>
</blockquote></blockquote><div class="im">
--<br>
Gerry O'Brien<br>
<br>
Systems Manager<br>
School of Computer Science and Statistics<br>
Trinity College Dublin<br>
Dublin 2<br>
IRELAND<br>
<br>
00 353 1 896 1341<br>
<br>
______________________________<u></u>**_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/**listinfo.cgi/users-opennebula.**org" target="_blank">http://lists.opennebula.org/**<u></u>listinfo.cgi/users-opennebula.<u></u>**org</a><<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.<u></u>org/listinfo.cgi/users-<u></u>opennebula.org</a>><br>
<br>
</div></blockquote></blockquote><div class="HOEnZb"><div class="h5">
<br>
<br>
-- <br>
Gerry O'Brien<br>
<br>
Systems Manager<br>
School of Computer Science and Statistics<br>
Trinity College Dublin<br>
Dublin 2<br>
IRELAND<br>
<br>
00 353 1 896 1341<br>
<br>
</div></div></blockquote></div><br></div>