Bug 1180746

Summary:	[RFE] Symbolic links should not point to a file outside the document root
Product:	Red Hat CloudForms Management Engine	Reporter:	Jared Deubel <jdeubel>
Component:	Appliance	Assignee:	Joe Rafaniello <jrafanie>
Status:	CLOSED ERRATA	QA Contact:	Pete Savage <psavage>
Severity:	low	Docs Contact:
Priority:	high
Version:	5.4.0	CC:	bkozdemb, dclarizi, jdeubel, jhardy, jrafanie, obarenbo, psavage, snansi, xlecauch
Target Milestone:	GA	Keywords:	FutureFeature
Target Release:	5.4.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	5.4.0.0.11	Doc Type:	Enhancement
Doc Text:	This version of CloudForms Management Engine removes all symbolic links in the HTTPD document root that were pointing to files outside the HTTPD document root. This feature enhances the security standards.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-06-16 12:47:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 9 Joe Rafaniello 2015-04-17 19:40:17 UTC

Pete, can you confirm making the change in this PR doesn't blow things up?

https://github.com/ManageIQ/manageiq/pull/2669


diff --git a/system/COPY/etc/httpd/conf.d/cfme-http.conf b/system/COPY/etc/httpd/conf.d/cfme-http.conf
index e49514b..475962d 100644
--- a/system/COPY/etc/httpd/conf.d/cfme-http.conf
+++ b/system/COPY/etc/httpd/conf.d/cfme-http.conf
@@ -5,7 +5,7 @@ Timeout 120

 # Disable this section if using HTTP only
 RewriteEngine On
-Options +FollowSymlinks
+Options SymLinksIfOwnerMatch


Restart apache and verify things start up and it should be good.

Comment 10 CFME Bot 2015-04-20 13:42:56 UTC

New commit detected on manageiq/master:
https://github.com/ManageIQ/manageiq/commit/692507edd4a28248f86182aa11aa7901e1464472

commit 692507edd4a28248f86182aa11aa7901e1464472
Author:     Joe Rafaniello <jrafanie>
AuthorDate: Fri Apr 17 15:33:38 2015 -0400
Commit:     Joe Rafaniello <jrafanie>
CommitDate: Fri Apr 17 15:34:42 2015 -0400

    Only allow symlinks in apache if the owner's match.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1180746
    
    [skip ci]

 system/COPY/etc/httpd/conf.d/cfme-http.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comment 12 Joe Rafaniello 2015-05-20 15:28:23 UTC

Pete, you can verify that the /etc/httpd/conf.d/cfme-http.conf has the changes mentioned in comment 9?  I'm not sure how to verify this bug any further.

Comment 13 Pete Savage 2015-06-03 06:23:02 UTC

The file is in place and the appliance is working, so I am verifying this

Verified in 5.4.0.4

Comment 15 errata-xmlrpc 2015-06-16 12:47:27 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1100.html