openstack team mailing list archive
Mailing list archive
Re: security blueprint related to os binaries
On Tue, May 14, 2013 at 9:25 AM, Mac Innes, Kiall <kiall@xxxxxx> wrote:
> On 14/05/13 12:02, Stanislav Pugachev wrote:
> I've added a blueprint
> Please, take a look and let's discuss it if it makes sense.
> Thank you
> Am I correct in thinking that, if the attacker is able to modify $PATH in
> the environment under which nova etc runs, you've already lost?
> I would argue this is at worst a packaging bug, assuming packagers are not
> explicitly defining the $PATH variable as part of the init scripts.
That and the PATH that any user with the rights to run nova services and
commands -- the general best practice is to make sure that all the entries
in $PATH are absolute paths, and that nothing in $PATH is world-writable.
> P.S. the openstack-dev mailing list is generally where blueprint
> discussion happens :)
> Mailing list: https://launchpad.net/~openstack
> Post to : openstack@xxxxxxxxxxxxxxxxxxx
> Unsubscribe : https://launchpad.net/~openstack
> More help : https://help.launchpad.net/ListHelp