yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

This needs to be fixed in filter definitions for each project, not in
the lib itself.

** Changed in: oslo
       Status: Triaged => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/948520

Title:
  nova-rootwrap does a poor job of validating parameters

Status in Cinder:
  Triaged
Status in OpenStack Compute (Nova):
  Triaged
Status in Oslo - a Library of Common OpenStack Code:
  Invalid

Bug description:
  Although nova-rootwrap does limit which commands can be run as root,
  it doesn't validate the parameters passed through.

  For example,  '/bin/dd' is allowed by by 'nova/rootwrap/compute.py'
  which can be exploited in the following fashion:

  'sudo nova-rootwrap dd if=/tmp/mypw of=/etc/passwd'

  This means that if someone can get nova user access they can gain root
  access.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/948520/+subscriptions