Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Importing LXD image without privileged permissions silently fails reporting success #4964

Closed
7 tasks
ospalax opened this issue Jul 3, 2020 · 1 comment
Closed
7 tasks

Comments

@ospalax
Copy link
Collaborator

ospalax commented Jul 3, 2020

/!\ To report a security issue please follow this procedure:
[https://github.com/OpenNebula/one/wiki/Vulnerability-Management-Process]

Description
Importing LXD image in constrained environment (e.g.: container) will report success but actually will store only empty disk. The reason for it is that mounting of the file as fs will silently fail due to restricted permissions.

To Reproduce
Run OpenNebula frontend in the container and try to import LXD image (you can try to use my project https://github.com/ospalax/onedocker) - the import will seem ok - but when you look inside the actual file - you will see only empty ext4 fs.

Expected behavior
Just fail.

Details

  • Affected Component: Storage
  • Hypervisor: LXD
  • Version: 5.12

Progress Status

  • Branch created
  • Code committed to development branch
  • Testing - QA
  • Documentation
  • Release notes - resolved issues, compatibility, known issues
  • Code committed to upstream release/hotfix branches
  • Documentation committed to upstream release/hotfix branches
@rsmontero
Copy link
Member

Added it also to resolved issues

rsmontero pushed a commit that referenced this issue Jul 23, 2020
rsmontero pushed a commit that referenced this issue Oct 6, 2020
Signed-off-by: Petr Ospalý <[email protected]>
(cherry picked from commit 4535528)
rsmontero pushed a commit that referenced this issue Jan 20, 2021
rsmontero pushed a commit that referenced this issue Apr 13, 2021
Signed-off-by: Petr Ospalý <[email protected]>
(cherry picked from commit 4535528)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants