No size restrictions in place for Images and Kernels

Bug #723996 reported by Antony Messerli
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
High
Johannes Erdfelt

Bug Description

There are currently no restrictions on the size of images or kernels that can be uploaded. Without restrictions, a hypervisors filesystem could be filled with junk data.

Related branches

Revision history for this message
Jay Pipes (jaypipes) wrote :

Hi! What would you propose would be a size limit? Or should it be configurable? Configurable by backend? In other words, filesystem backend could be different size limit from Swift backend?

Revision history for this message
Antony Messerli (antonym) wrote :

In order to be flexible, the size limit should be configurable. The main idea is to protect the hypervisor and prevent situations where large kernels or images were registered on purpose to cause host issues. For example, XenServer only provides 4GB for dom0. For builds with kernels outside of the instance, they are stored on the dom0 filesystem in /boot/guest and at a certain point could fill up the filesystem if not kept in check.

In talking with Rick Harris it would probably be set at the compute layer, either a limit per image or file, or an overall filesystem percentage free space check.

Revision history for this message
Jay Pipes (jaypipes) wrote :

OK, thx Ant! Moving to the Nova project, as Rick says, better to do the limiting at the compute layer.

affects: glance → nova
Revision history for this message
Thierry Carrez (ttx) wrote :

Setting as High due to potential security implications

Changed in nova:
importance: Undecided → High
status: New → Confirmed
Changed in nova:
assignee: nobody → Johannes Erdfelt (johannes.erdfelt)
Changed in nova:
status: Confirmed → In Progress
Thierry Carrez (ttx)
Changed in nova:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
milestone: none → diablo-1
Thierry Carrez (ttx)
Changed in nova:
milestone: diablo-1 → 2011.3
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.