yahoo-eng-team team mailing list archive

Thread
Date

[Bug 1700501] Re: Insecure rootwrap usage

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Jeremy Stanley <fungi@xxxxxxxxxxx>
Date: Tue, 27 Jun 2017 18:43:27 -0000
Reply-to: Bug 1700501 <1700501@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: ossa
       Status: Incomplete => Won't Fix

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1700501

Title:
  Insecure rootwrap usage

Status in Cinder:
  New
Status in Manila:
  New
Status in OpenStack Compute (nova):
  New
Status in OpenStack Security Advisory:
  Won't Fix

Bug description:
  Reported by Benjamin Deuter of SUSE:

  Some rootwrap filters are too permissive and allow privilege
  escalation from service user, as explained here:

  https://security.openstack.org/guidelines/dg_use-oslo-rootwrap-
  securely.html#incorrect

  For example this shouldn't be authorized:

  sudo nova-rootwrap /etc/nova/rootwrap.conf chmod 777 /etc/shadow

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1700501/+subscriptions