nbdkit-protect-filter1

Usage

Overview

"nbdkit-protect-filter" is a filter for nbdkit(1) that lets you write-protect parts of the underlying plugin. This prevents clients from modifying ranges of the plugin, while still allowing the NBD connection to be writable in general.

One use for this is to prevent clients from adding a phony header to the data to make it look like a non-raw disk format (like adding a qcow2 header), since that can be used in some exploits.

To make the whole plugin readonly, use the nbdkit -r option on the command line, or nbdkit-readonly-filter(1). To give selective access to the server, use nbdkit-ip-filter(1). To serve only a subset of the plugin use nbdkit-offset-filter(1) or nbdkit-partition-filter(1).

Examples

 nbdkit --filter=protect file disk.img protect=0-0x1bd

 $ fdisk -l disk.img
 Device    Boot  Start       End  Sectors Size Id Type
 disk.img1 *      2048  12580863 12578816   6G 83 Linux
 $ start=$((2048*512))
 $ end=$((12580863*512+511))
 $ nbdkit --filter=protect file disk.img protect=~$start-$end

Parameters

protect=START-END

Protect the bytes starting at offset "START" through to offset "END" (inclusive). Reads are permitted. Writes to the protected range are only permitted if they do not change the content. If an attempt is made to change the content, then the error "NBD_EPERM" (Operation not permitted) is returned to the client.

"START" and "END" can be expressed in decimal, octal ("0NN") or hexadecimal ("0xNN"). If omitted then they default to the start and end of the underlying plugin respectively.

This parameter can be given multiple times to protect several ranges.

protect=~START-END

This protects the complement of the range "START" to "END".

Files

$filterdir/nbdkit-protect-filter.so

The filter.

Use "nbdkit --dump-config" to find the location of $filterdir.

Version

"nbdkit-protect-filter" first appeared in nbdkit 1.30.