openstack team mailing list archive

["Richard W.M. Jones" <rich@xxxxxxxxxxx>]

On Sat, Apr 07, 2012 at 08:53:12PM -0400, Nathanael Burton wrote:
> Better yet why not add support in Glance for automatically determining
> those things (distro, versions, etc)[1]. That way you don't have to rely on
> people doing the right thing.

[Sorry I'm a little late to the party]

Just a note of caution around using virt-inspector:

You shouldn't rely on its output in the case where (a) you're using it
against an untrusted guest image, and (b) billing or some other
money-related event relies on the output.

The reason is that virt-inspector parses files from the guest.  For
example it'll read /etc/debian_version or the Windows registry to get
its results.  These files can be easily altered by a user to simulate
another guest for the purposes of billing.

Having said that, running it on trusted images is no problem.  Also,
it is safe to run virt-inspector on any image, in as much as it won't
crash and Bad Things won't happen.  It's written to be robust against
untrusted data -- just don't depend on the output for billing purposes.

BTW, since OpenStack is a python program, you may prefer to use the
python Inspection API directly.  See:
http://libguestfs.org/guestfs-python.3.html#example_2__inspect_a_virtual_machine_disk_image
http://libguestfs.org/guestfs.3.html#inspection

Best of luck and do ask me if you have questions.

Rich.

-- 
Richard Jones
Red Hat