Bug 1431464

Summary:	openstack-gnocchi: /var/log/gnocchi is world readable
Product:	Red Hat OpenStack	Reporter:	Summer Long <slong>
Component:	openstack-gnocchi	Assignee:	Pradeep Kilambi <pkilambi>
Status:	CLOSED ERRATA	QA Contact:	Sasha Smolyak <ssmolyak>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0 (Mitaka)	CC:	apevec, eglynn, jruzicka, jschluet, lhh, srevivo, ssmolyak
Target Milestone:	rc	Keywords:	Security, Triaged
Target Release:	11.0 (Ocata)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-gnocchi-3.1.2-1.el7ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1431462
Clones:	1431465 (view as bug list)		Environment:
Last Closed:	2017-05-17 20:06:46 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Summer Long 2017-03-12 23:31:58 UTC

Description of problem:
The directory /var/log/gnocchi is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/gnocchi directory.

Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw.

Version-Release number of selected component (if applicable):
openstack-gnocchi-2.1.3-3.el7ost

How reproducible:
List /var/log directory for openstack-gnocchi:
$  ls -la gnocchi
total 72
drwxr-xr-x.  2 gnocchi root       67 Mar  7 20:25 .
drwxr-xr-x. 29 root    root     4096 Mar 12 19:20 ..
-rw-r--r--.  1 gnocchi gnocchi   322 Mar  7 20:25 gnocchi-upgrade.log
-rw-r--r--.  1 gnocchi gnocchi 26511 Mar 12 19:23 metricd.log
-rw-r--r--.  1 gnocchi gnocchi 29540 Mar 12 19:21 statsd.log

Actual results:
Directory and files are world readable.

Expected results:
Directory and files should not be world readable.

Comment 1 Pradeep Kilambi 2017-03-13 13:02:46 UTC

this has been fixed in master rdo already. I backported to ocata.

Comment 4 Sasha Smolyak 2017-04-25 11:38:19 UTC

[stack@undercloud-0 log]$ ls -la gnocchi
ls: cannot open directory gnocchi: Permission denied
[stack@undercloud-0 log]$ ls -lart gnocchi
ls: cannot open directory gnocchi: Permission denied
[stack@undercloud-0 log]$ sudo ls -lart gnocchi
total 24
-rw-r--r--.  1 gnocchi gnocchi 1090 Apr 25 06:28 gnocchi-upgrade.log
-rw-r--r--.  1 gnocchi gnocchi  611 Apr 25 06:28 statsd.log
drwxr-x---.  2 gnocchi root      85 Apr 25 06:31 .
-rw-r--r--.  1 gnocchi gnocchi 2683 Apr 25 06:31 app.log
drwxr-xr-x. 34 root    root    4096 Apr 25 07:09 ..
-rw-r--r--.  1 gnocchi gnocchi 4415 Apr 25 07:34 metricd.log

Comment 5 errata-xmlrpc 2017-05-17 20:06:46 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1245