Merge pull request #83 from stackhpc/yoga-cve-2024-32498

yoga: Backport fixes for CVE-2024-32498
stackhpc · Jul 9, 2024 · ab8bd79 · ab8bd79
2 parents 7b5f3b0 + 37e0f4b
commit ab8bd79
Show file tree

Hide file tree

Showing 9 changed files with 1,290 additions and 15 deletions.
diff --git a/nova/conf/workarounds.py b/nova/conf/workarounds.py
@@ -431,6 +431,16 @@
 Howerver, if you don't use automatic cleaning, it can cause an
 extra delay before and Ironic node is available for building a
 new Nova instance.
+"""),
+    cfg.BoolOpt(
+        'disable_deep_image_inspection',
+        default=False,
+        help="""
+This disables the additional deep image inspection that the compute node does
+when downloading from glance. This includes backing-file, data-file, and
+known-features detection *before* passing the image to qemu-img. Generally,
+this inspection should be enabled for maximum safety, but this workaround
+option allows disabling it if there is a compatibility concern.
 """),
 ]