Bug 1431480

Summary:	openstack-ironic: /var/log/ironic is world readable
Product:	Red Hat OpenStack	Reporter:	Summer Long <slong>
Component:	openstack-ironic	Assignee:	Derek Higgins <derekh>
Status:	CLOSED ERRATA	QA Contact:	mlammon
Severity:	high	Docs Contact:
Priority:	high
Version:	9.0 (Mitaka)	CC:	apevec, bfournie, derekh, eglynn, jamsmith, jruzicka, jschluet, lhh, lmartins, mburns, pkilambi, rbartal, rhel-osp-director-maint, srevivo, ssmolyak
Target Milestone:	zstream	Keywords:	Security, Triaged, ZStream
Target Release:	9.0 (Mitaka)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-ironic-5.1.3-2	Doc Type:	Bug Fix
Doc Text:	This update changes the ironic log directory default permissions so that ironic logs are no longer world readable by default.	Story Points:	---
Clone Of:	1431479
Clones:	1431482 (view as bug list)		Environment:
Last Closed:	2018-10-02 18:52:22 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Summer Long 2017-03-13 00:50:13 UTC

Description of problem:
The directory /var/log/ironic is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/ironic directory.

Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw.

Version-Release number of selected component (if applicable):
openstack-ironic-5.1.2-3.el7ost

How reproducible:
List /var/log directory for openstack-ironic:
$ ls -la ironic
total 1292
drwxr-xr-x.  2 ironic ironic     78 Mar  7 22:58 .
drwxr-xr-x. 29 root   root     4096 Mar 12 19:20 ..
-rw-r--r--.  1 ironic ironic 361530 Mar 12 19:23 ironic-api.log
-rw-r--r--.  1 ironic ironic 656283 Mar 12 19:22 ironic-conductor.log
-rw-r--r--.  1 root   root        0 Mar  7 20:04 ironic-dbsync.log

Actual results:
Directory and files are world readable.

Expected results:
Directory and files should not be world readable.

Comment 1 Dmitry Tantsur 2017-04-25 09:56:19 UTC

Derek, mind proposing a backport of https://review.rdoproject.org/r/#/c/5258/ please?

Comment 2 Bob Fournier 2018-03-21 13:42:28 UTC

Derek - regarding the "Fixed In Version" - I don't see openstack-ironic-5.1.3-2 in brew and the latest 9z release has openstack-ironic-5.1.3-1.

Comment 3 Derek Higgins 2018-04-17 13:46:36 UTC

Sorry, I had updated the packaging but not built it, I've built it now 
openstack-ironic-5.1.3-2.el7ost

Comment 9 mlammon 2018-08-31 19:54:26 UTC

Installed latest rhos 9  2018-08-23.1

[stack@undercloud-0 ~]$ ll /var/log | grep ironic
drwxr-x---. 2 ironic     ironic          6 Apr 17 09:43 ironic
[stack@undercloud-0 ~]$ cat core_puddle_version
2018-08-23.1[stack@undercloud-0 ~]$ less /etc/yum.repos.d/
latest-installed                rhos-release-9-director.repo    rhos-release-ceph-1.3.repo      rhos-release.repo
mirror-readme                   rhos-release-9.repo             rhos-release-ceph-osd-1.3.repo  rhos-release-rhel-7.5.repo

environment
[stack@undercloud-0 ~]$ rpm -qa | grep openstack-ironic
openstack-ironic-inspector-3.2.2-4.el7ost.noarch
openstack-ironic-common-5.1.3-2.el7ost.noarch
openstack-ironic-api-5.1.3-2.el7ost.noarch
openstack-ironic-conductor-5.1.3-2.el7ost.noarch

Comment 12 errata-xmlrpc 2018-10-02 18:52:22 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2854