From: Thomas Lamprecht <t.lamprecht@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>,
Fiona Ebner <f.ebner@proxmox.com>
Subject: [pve-devel] applied: [PATCH guest-common] fix #6130: remote migration: untaint bandwidth limit from remote
Date: Mon, 10 Feb 2025 16:52:45 +0100 [thread overview]
Message-ID: <ceb7cb17-9b74-4d80-9975-9fd4426c0203@proxmox.com> (raw)
In-Reply-To: <20250210135605.53763-1-f.ebner@proxmox.com>
Am 10.02.25 um 14:56 schrieb Fiona Ebner:
> Remote migration via API will be invoked under Perl's '-T' switch to
> detect tainted input used in commands. For remote migration, the
> bandwidth limit from the remote side would be such tainted input. This
> would lead to failure for offline disk migration when the target
> node's bandwidth limit is stricter when invoking the 'pvesm export'
> command:
>
>> command 'set -o pipefail && pvesm export rbd:vm-400-disk-0 \
>> raw+size - -with-snapshots 0 | /usr/bin/cstream -t 307232768' \
>> failed: Insecure dependency in exec while running with -T switch
>
> Untaint the value to fix the issue. Note that the schema for the
> bandwidth limits in datacenter.cfg and storage.cfg allows fractional
> values.
>
> Avoid re-using the same variable for both, the reply from the remote
> (which is a hash) and the actual remote bandwidth limit. This also
> makes it possible to use the "assign regex match or die" pattern while
> accessing the original value in the error message.
>
> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
> src/PVE/AbstractMigrate.pm | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
>
applied, thanks!
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
prev parent reply other threads:[~2025-02-10 15:53 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-10 13:56 [pve-devel] " Fiona Ebner
2025-02-10 15:52 ` Thomas Lamprecht [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ceb7cb17-9b74-4d80-9975-9fd4426c0203@proxmox.com \
--to=t.lamprecht@proxmox.com \
--cc=f.ebner@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.