Bug 1431483

Summary: openstack-ironic-inspector: /var/log/ironic-inspector is world readable
Product: Red Hat OpenStack Reporter: Summer Long <slong>
Component: openstack-ironic-inspectorAssignee: Dmitry Tantsur <dtantsur>
Status: CLOSED ERRATA QA Contact: Raviv Bar-Tal <rbartal>
Severity: high Docs Contact:
Priority: high    
Version: 10.0 (Newton)CC: apevec, bfournie, eglynn, jjoyce, jruzicka, jschluet, lhh, lmartins, mburns, pkilambi, rbartal, rhel-osp-director-maint, slinaber, srevivo, ssmolyak
Target Milestone: z4Keywords: OtherQA, Security, Triaged, ZStream
Target Release: 10.0 (Newton)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-ironic-inspector-4.2.2-3.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1431479
: 1431484 (view as bug list) Environment:
Last Closed: 2017-09-06 17:16:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Summer Long 2017-03-13 01:03:38 UTC 
Description of problem:
The directory /var/log/ironic-inspector is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/ironic directory.

Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw.

Version-Release number of selected component (if applicable):
openstack-ironic-inspector-4.2.1-2.el7ost

How reproducible:
List /var/log directory for openstack-ironic-inspector:
$ ls -la ironic-inspector
total 7936
drwxr-xr-x.  3 ironic-inspector ironic-inspector    4096 Mar 10 03:29 .
drwxr-xr-x. 31 root             root                4096 Mar  5 18:23 ..
-rw-r--r--.  1 ironic-inspector ironic-inspector 6789347 Mar 12 21:00 ironic-inspector.log
-rw-r--r--.  1 ironic-inspector ironic-inspector  317198 Feb 21 03:27 ironic-inspector.log-20170221.gz
-rw-r--r--.  1 ironic-inspector ironic-inspector  354698 Feb 26 03:34 ironic-inspector.log-20170226.gz
-rw-r--r--.  1 ironic-inspector ironic-inspector  331045 Mar  5 18:22 ironic-inspector.log-20170305.gz
-rw-r--r--.  1 ironic-inspector ironic-inspector  309486 Mar 10 03:28 ironic-inspector.log-20170310.gz
drwxr-xr-x.  2 ironic-inspector ironic-inspector    4096 Jan 13 12:38 ramdisk


Actual results:
Directory and files are world readable.

Expected results:
Directory and files should not be world readable.
Comment 1 Dmitry Tantsur 2017-03-13 12:34:03 UTC 
Fix merged in RDO: https://review.rdoproject.org/r/#/c/5793/
Comment 4 Bob Fournier 2017-08-17 21:45:14 UTC 
Verified in openstack-ironic-inspector-4.2.2-3.el7ost.noarch

drwxr-x---.  3 ironic-inspector ironic-inspector      49 Aug 17 17:21 ironic-inspector

[stack@host06 log]$ ls -al ironic-inspector
ls: cannot open directory ironic-inspector: Permission denied
Comment 7 errata-xmlrpc 2017-09-06 17:16:25 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2659