yahoo-eng-team team mailing list archive

Thread
Date

[Bug 948520] Re: nova-rootwrap does a poor job of validating parameters

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: "Davanum Srinivas \(DIMS\)" <davanum@xxxxxxxxx>
Date: Fri, 28 Aug 2015 01:26:30 -0000
Reply-to: Bug 948520 <948520@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: nova
       Status: Confirmed => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/948520

Title:
  nova-rootwrap does a poor job of validating parameters

Status in Cinder:
  Triaged
Status in OpenStack Compute (nova):
  Invalid
Status in oslo-incubator:
  Invalid

Bug description:
  Although nova-rootwrap does limit which commands can be run as root,
  it doesn't validate the parameters passed through.

  For example,  '/bin/dd' is allowed by by 'nova/rootwrap/compute.py'
  which can be exploited in the following fashion:

  'sudo nova-rootwrap dd if=/tmp/mypw of=/etc/passwd'

  This means that if someone can get nova user access they can gain root
  access.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/948520/+subscriptions