)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"4f287cbe19e3c47bb28850ba810c477145311685","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Hemanth Makkapati \u003chemanth.makkapati@rackspace.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-09-23 09:35:49 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"cpu and address space limitations on qemu-img"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"All ``qemu-img`` calls are now run under resource limitations that"},{"line_number":10,"context_line":"limit cpu time to 2 seconds and address space usage to 1 GB."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a8bc5a2_fc0d093f","line":7,"updated":"2016-09-23 14:53:34.000000000","message":"Can we capitalize CPU please?","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Hemanth Makkapati \u003chemanth.makkapati@rackspace.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-09-23 09:35:49 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"cpu and address space limitations on qemu-img"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"All ``qemu-img`` calls are now run under resource limitations that"},{"line_number":10,"context_line":"limit cpu time to 2 seconds and address space usage to 1 GB."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a8bc5a2_bb453e18","line":7,"in_reply_to":"5a8bc5a2_fc0d093f","updated":"2016-09-23 20:23:21.000000000","message":"Done","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"fa1501e540232ac4c3626276f65fd1712c813499","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"cpu and address space limitations on qemu-img"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"All ``qemu-img`` calls are now run under resource limitations that"},{"line_number":10,"context_line":"limit cpu time to 2 seconds and address space usage to 1 GB."},{"line_number":11,"context_line":"This helps avoid any DoS attacks via malicious images."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a8bc5a2_629070ed","line":9,"updated":"2016-09-23 15:25:50.000000000","message":"I\u0027m subject to correction here, but my impression from the bug is that it\u0027s the qemu-img info call that requires the limits; the DOS vector is that you run out of resources just looking at the image.  I think in order for qemu-img to do actual work, it\u0027s going to require more resources.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"cpu and address space limitations on qemu-img"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"All ``qemu-img`` calls are now run under resource limitations that"},{"line_number":10,"context_line":"limit cpu time to 2 seconds and address space usage to 1 GB."},{"line_number":11,"context_line":"This helps avoid any DoS attacks via malicious images."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a8bc5a2_fb6ee694","line":9,"in_reply_to":"5a8bc5a2_629070ed","updated":"2016-09-23 20:23:21.000000000","message":"Done","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"4f287cbe19e3c47bb28850ba810c477145311685","unresolved":false,"context_lines":[{"line_number":9,"context_line":"All ``qemu-img`` calls are now run under resource limitations that"},{"line_number":10,"context_line":"limit cpu time to 2 seconds and address space usage to 1 GB."},{"line_number":11,"context_line":"This helps avoid any DoS attacks via malicious images."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Ib900bbc05cb9ccd90c6f56ccb4bf2006e30cdc80"},{"line_number":14,"context_line":"Closes-Bug: #1449062"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a8bc5a2_1c09d531","line":12,"updated":"2016-09-23 14:53:34.000000000","message":"Since I have a couple other nits can we also add SecurityImpact tag here (or do we no longer tag commits)?","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":9,"context_line":"All ``qemu-img`` calls are now run under resource limitations that"},{"line_number":10,"context_line":"limit cpu time to 2 seconds and address space usage to 1 GB."},{"line_number":11,"context_line":"This helps avoid any DoS attacks via malicious images."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Ib900bbc05cb9ccd90c6f56ccb4bf2006e30cdc80"},{"line_number":14,"context_line":"Closes-Bug: #1449062"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a8bc5a2_bb5c5eee","line":12,"in_reply_to":"5a8bc5a2_1c09d531","updated":"2016-09-23 20:23:21.000000000","message":"Done","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"c25087a56d3a1d1bc4ff83233b6e02791f0bb135","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Hemanth Makkapati \u003chemanth.makkapati@rackspace.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-09-26 11:36:29 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"CPU and address space limitations on qemu-img info"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"All \"qemu-img info\" calls are now run under resource limitations"},{"line_number":10,"context_line":"that limit CPU time to 2 seconds and address space usage to 1 GB."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5a8bc5a2_5e04da48","line":7,"updated":"2016-09-26 17:40:11.000000000","message":"Maybe change to \"Adding constraints around qemu-img calls\", and then make the body two bullet points:\n\n* (the paragraph you have below)\n* All \"qemu-img convert\" calls now specify the import format so that this does not have to be inferred by qemu-img","commit_id":"1daafbcc638fa85a6cb13b6e9a77cdc22f373c84"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"9a294a69ccd224fee518fe9b7f1f70fb774c2db9","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Hemanth Makkapati \u003chemanth.makkapati@rackspace.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-09-26 11:36:29 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"CPU and address space limitations on qemu-img info"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"All \"qemu-img info\" calls are now run under resource limitations"},{"line_number":10,"context_line":"that limit CPU time to 2 seconds and address space usage to 1 GB."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5a8bc5a2_5c7ea219","line":7,"in_reply_to":"5a8bc5a2_5e04da48","updated":"2016-09-26 17:51:09.000000000","message":"Done","commit_id":"1daafbcc638fa85a6cb13b6e9a77cdc22f373c84"}],"glance/async/flows/base_import.py":[{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"ffa34758bf24ed9fd1d142fc0b7433dcfcc645f0","unresolved":false,"context_lines":[{"line_number":153,"context_line":"        try:"},{"line_number":154,"context_line":"            # NOTE(flaper87): Consider moving this code to a common"},{"line_number":155,"context_line":"            # place that other tasks can consume as well."},{"line_number":156,"context_line":"            stdout, stderr \u003d putils.trycmd(\u0027qemu-img\u0027, \u0027info\u0027,"},{"line_number":157,"context_line":"                                           \u0027--output\u003djson\u0027, path,"},{"line_number":158,"context_line":"                                           prlimit\u003dutils.QEMU_IMG_LIMITS,"},{"line_number":159,"context_line":"                                           log_errors\u003dputils.LOG_ALL_ERRORS)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_628dd07a","line":156,"range":{"start_line":156,"start_character":12,"end_line":156,"end_character":53},"updated":"2016-09-23 15:16:26.000000000","message":"this method seems to have been used in multiple flows.\n\ncan we move this to script_utils or a common module parameterized? \n\nthis will avoid future regressions for newly introduced flows or any flows operators keep downstream.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":153,"context_line":"        try:"},{"line_number":154,"context_line":"            # NOTE(flaper87): Consider moving this code to a common"},{"line_number":155,"context_line":"            # place that other tasks can consume as well."},{"line_number":156,"context_line":"            stdout, stderr \u003d putils.trycmd(\u0027qemu-img\u0027, \u0027info\u0027,"},{"line_number":157,"context_line":"                                           \u0027--output\u003djson\u0027, path,"},{"line_number":158,"context_line":"                                           prlimit\u003dutils.QEMU_IMG_LIMITS,"},{"line_number":159,"context_line":"                                           log_errors\u003dputils.LOG_ALL_ERRORS)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_732cc4ab","line":156,"range":{"start_line":156,"start_character":12,"end_line":156,"end_character":53},"in_reply_to":"5a8bc5a2_628dd07a","updated":"2016-09-23 20:23:21.000000000","message":"Yes, maybe but I think we can do that in a separate patch. What say?","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"c1f0ac1a67e54fa5806f23ecee0487151e7f6545","unresolved":false,"context_lines":[{"line_number":153,"context_line":"        try:"},{"line_number":154,"context_line":"            # NOTE(flaper87): Consider moving this code to a common"},{"line_number":155,"context_line":"            # place that other tasks can consume as well."},{"line_number":156,"context_line":"            stdout, stderr \u003d putils.trycmd(\u0027qemu-img\u0027, \u0027info\u0027,"},{"line_number":157,"context_line":"                                           \u0027--output\u003djson\u0027, path,"},{"line_number":158,"context_line":"                                           prlimit\u003dutils.QEMU_IMG_LIMITS,"},{"line_number":159,"context_line":"                                           log_errors\u003dputils.LOG_ALL_ERRORS)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_6d6213af","line":156,"range":{"start_line":156,"start_character":12,"end_line":156,"end_character":53},"in_reply_to":"5a8bc5a2_732cc4ab","updated":"2016-09-23 20:33:33.000000000","message":"hm, not sure may be may be not. please see my latest comment after rosmaita posted another set of comments. if that doesn\u0027t help I\u0027m okay with separate patch.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"}],"glance/async/flows/convert.py":[{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"b904f78be856f417aa25f323d46c568f534a7800","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        dest_path \u003d os.path.join(CONF.task.work_dir, \"%s.converted\" % image_id)"},{"line_number":109,"context_line":"        stdout, stderr \u003d putils.trycmd(\u0027qemu-img\u0027, \u0027convert\u0027, \u0027-O\u0027,"},{"line_number":110,"context_line":"                                       conversion_format, file_path, dest_path,"},{"line_number":111,"context_line":"                                       prlimit\u003dutils.QEMU_IMG_LIMITS,"},{"line_number":112,"context_line":"                                       log_errors\u003dputils.LOG_ALL_ERRORS)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        if stderr:"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_42aff480","line":111,"updated":"2016-09-23 15:19:10.000000000","message":"Is 2 seconds CPU enough for an actual conversion? I am thinking not.\n\nMay have to implement Flavio\u0027s TODO here to do a prlimit\u0027d info call on the supplied image, and if it fails, don\u0027t do the conversion? Is that reasonable?","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        dest_path \u003d os.path.join(CONF.task.work_dir, \"%s.converted\" % image_id)"},{"line_number":109,"context_line":"        stdout, stderr \u003d putils.trycmd(\u0027qemu-img\u0027, \u0027convert\u0027, \u0027-O\u0027,"},{"line_number":110,"context_line":"                                       conversion_format, file_path, dest_path,"},{"line_number":111,"context_line":"                                       prlimit\u003dutils.QEMU_IMG_LIMITS,"},{"line_number":112,"context_line":"                                       log_errors\u003dputils.LOG_ALL_ERRORS)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        if stderr:"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_08042b48","line":111,"in_reply_to":"5a8bc5a2_42aff480","updated":"2016-09-23 20:23:21.000000000","message":"Like you said, the CVE is specifically for \"info\" calls. We actually don\u0027t need the process limits here I think.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"}],"glance/async/flows/introspect.py":[{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"129f0852f82b316b33d10822b0499670a1be1929","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"class _Introspect(utils.OptionalTask):"},{"line_number":32,"context_line":"    \"\"\"Taskflow to pull the embedded metadata out of image file\"\"\""},{"line_number":33,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_bce9c182","side":"PARENT","line":30,"updated":"2016-09-23 14:51:29.000000000","message":"hmmm, this was accidental","commit_id":"b9237e33f7aa61c0f880e482b1c55301723c7efc"}],"glance/async/utils.py":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"4f287cbe19e3c47bb28850ba810c477145311685","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":26,"context_line":"QEMU_IMG_LIMITS \u003d putils.ProcessLimits(cpu_time\u003d2, address_space\u003d1 * units.Gi)"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"class OptionalTask(task.Task):"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_3c08512c","line":26,"updated":"2016-09-23 14:53:34.000000000","message":"I hate to be that person, but this will be more maintainable with two things:\n\n1. A comment explaining *why* preferably with a link to the bug\n2. Changing the name to `QEMU_IMG_PROC_LIMITS` to indicate (when read in other modules) what it\u0027s doing","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"26bc446189ee7aa8dfdd24a01b4a3596c690f91f","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":26,"context_line":"QEMU_IMG_LIMITS \u003d putils.ProcessLimits(cpu_time\u003d2, address_space\u003d1 * units.Gi)"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"class OptionalTask(task.Task):"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_ffa41ba7","line":26,"in_reply_to":"5a8bc5a2_3c08512c","updated":"2016-09-23 15:06:00.000000000","message":"Agree.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":26,"context_line":"QEMU_IMG_LIMITS \u003d putils.ProcessLimits(cpu_time\u003d2, address_space\u003d1 * units.Gi)"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"class OptionalTask(task.Task):"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_73ef64b0","line":26,"in_reply_to":"5a8bc5a2_3c08512c","updated":"2016-09-23 20:23:21.000000000","message":"Done","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"}],"glance/tests/unit/async/flows/test_convert.py":[{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"687f1e8af20c3a0842324021832d3db8241cfcb7","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"                # NOTE(hemanthm): Asserting that the source format is passed"},{"line_number":98,"context_line":"                # to qemu-utis to avoid inferring the image format. This"},{"line_number":99,"context_line":"                # shields us from an attack vector described in bug #1449062"},{"line_number":100,"context_line":"                self.assertIn(\u0027-f\u0027, exc_mock.call_args[0])"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    def test_convert_revert_success(self):"}],"source_content_type":"text/x-python","patch_set":4,"id":"5a8bc5a2_8b39c2d9","line":99,"range":{"start_line":99,"start_character":37,"end_line":99,"end_character":76},"updated":"2016-09-26 17:18:16.000000000","message":"add comment number too, in case more attack vectors are found later (but I realize that it\u0027s a less probability)","commit_id":"1daafbcc638fa85a6cb13b6e9a77cdc22f373c84"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"9a294a69ccd224fee518fe9b7f1f70fb774c2db9","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"                # NOTE(hemanthm): Asserting that the source format is passed"},{"line_number":98,"context_line":"                # to qemu-utis to avoid inferring the image format. This"},{"line_number":99,"context_line":"                # shields us from an attack vector described in bug #1449062"},{"line_number":100,"context_line":"                self.assertIn(\u0027-f\u0027, exc_mock.call_args[0])"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    def test_convert_revert_success(self):"}],"source_content_type":"text/x-python","patch_set":4,"id":"5a8bc5a2_5c978247","line":99,"range":{"start_line":99,"start_character":37,"end_line":99,"end_character":76},"in_reply_to":"5a8bc5a2_8b39c2d9","updated":"2016-09-26 17:51:09.000000000","message":"Done","commit_id":"1daafbcc638fa85a6cb13b6e9a77cdc22f373c84"}],"releasenotes/notes/add-processlimits-to-qemu-img-c215f5d90f741d8a.yaml":[{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"ffa34758bf24ed9fd1d142fc0b7433dcfcc645f0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"prelude: \u003e"},{"line_number":3,"context_line":"    Add cpu and address space limitations to qemu-img calls"},{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_226f4893","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":10},"updated":"2016-09-23 15:16:26.000000000","message":"yep, we sorta agreed to keep prelude with bullet points so in future make sure to keep the \"-\".\n\nsee the formatting looks better with \"-\" http://docs.openstack.org/releasenotes/glance/newton.html\n\nalso, may be a good time to update our relnotes dev doc to indicate when to include prelude https://review.openstack.org/#/c/365063/ (hint hint, has a +2) :)","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"f97a26065c27f29b9d8a0e5a5742b3687a66b8f9","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"prelude: \u003e"},{"line_number":3,"context_line":"    Add cpu and address space limitations to qemu-img calls"},{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_42229401","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":10},"in_reply_to":"5a8bc5a2_226f4893","updated":"2016-09-23 15:22:18.000000000","message":"@Hemanth: please take a look at the patch Nikhil linked above and then +2A it already!  I didn\u0027t realize that was still sitting unmerged.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"prelude: \u003e"},{"line_number":3,"context_line":"    Add cpu and address space limitations to qemu-img calls"},{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_eece27b3","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":10},"in_reply_to":"5a8bc5a2_42229401","updated":"2016-09-23 20:23:21.000000000","message":"+1\u0027d Nikhil\u0027s patch with a comment.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"eb7bee932f5d134415d306982ef8c16a976ade20","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"prelude: \u003e"},{"line_number":3,"context_line":"    Add cpu and address space limitations to qemu-img calls"},{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_0dc0af7a","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":10},"in_reply_to":"5a8bc5a2_eece27b3","updated":"2016-09-23 20:32:08.000000000","message":"If you\u0027ve a strong opinion that doesn\u0027t make you confident to give +2, you are welcome to propose a change (new PS). if your suggestion is small, you prolly won\u0027t want a co-author (not sure but that was just a guess). if so, your +2 is very valid so the patch can move quickly.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"26bc446189ee7aa8dfdd24a01b4a3596c690f91f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"prelude: \u003e"},{"line_number":3,"context_line":"    Add cpu and address space limitations to qemu-img calls"},{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"},{"line_number":6,"context_line":"    limitations that limit cpu time to 2 seconds and"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_ff6edb2d","line":3,"updated":"2016-09-23 15:06:00.000000000","message":"I don\u0027t think this needs to be mentioned in the prelude, you can remove this section.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"prelude: \u003e"},{"line_number":3,"context_line":"    Add cpu and address space limitations to qemu-img calls"},{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"},{"line_number":6,"context_line":"    limitations that limit cpu time to 2 seconds and"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_0ec6f399","line":3,"in_reply_to":"5a8bc5a2_ff6edb2d","updated":"2016-09-23 20:23:21.000000000","message":"Done","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"ffa34758bf24ed9fd1d142fc0b7433dcfcc645f0","unresolved":false,"context_lines":[{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"},{"line_number":6,"context_line":"    limitations that limit cpu time to 2 seconds and"},{"line_number":7,"context_line":"    address space usage to 1 GB. This addresses the bug"},{"line_number":8,"context_line":"    https://bugs.launchpad.net/glance/+bug/1449062"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_02fb2cc2","line":7,"updated":"2016-09-23 15:16:26.000000000","message":"this sentence looks a bit incomplete to me, please correct if I\u0027m wrong.\n\nI think you need to complete the scenario when this limitations are imposed (in terms of processes, threads, task types, etc.)\n\nalso, need to mention that any call to the method running qemu-img will need to have such limitations in the future flows or any extra downstream flows.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ba4839212fc99f324825681d7e5879526177a20c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - All ``qemu-img`` calls are now run under resource"},{"line_number":6,"context_line":"    limitations that limit cpu time to 2 seconds and"},{"line_number":7,"context_line":"    address space usage to 1 GB. This addresses the bug"},{"line_number":8,"context_line":"    https://bugs.launchpad.net/glance/+bug/1449062"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5a8bc5a2_bb9d3e5b","line":7,"in_reply_to":"5a8bc5a2_02fb2cc2","updated":"2016-09-23 20:23:21.000000000","message":"The reported CVE is only for \"qemu-img info\" calls. I don\u0027t know if we have to limit resources for all qemu-img calls. I\u0027m guessing we have to come up with sane limits for other qemu-img calls/commands.","commit_id":"f6dcd46302f61eb511e1db208fd0191d063794ba"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"c25087a56d3a1d1bc4ff83233b6e02791f0bb135","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"5a8bc5a2_01daf34b","line":8,"updated":"2016-09-26 17:40:11.000000000","message":"I think this is fine, I don\u0027t think we need to mention the change around the convert call here.","commit_id":"1daafbcc638fa85a6cb13b6e9a77cdc22f373c84"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"3666e1024629e86e0ad79f94c3d62bbe1b8acda4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"5a8bc5a2_32cd7fb7","line":8,"updated":"2016-09-26 18:09:59.000000000","message":"Maybe add \"Current usage of qemu-img is limited to Glance tasks, which by default (since the Liberty release) are only available to admin users.  We continue to recommend that tasks only be exposed to trusted users.","commit_id":"a8cd0c10fd3839e92457b3ade7e1fb9290d9420b"}]}