Bug 1815537

Summary:	baremetal image requires /etc/passwd be writable
Product:	OpenShift Container Platform	Reporter:	Andrea Fasano <afasano>
Component:	Installer	Assignee:	Andrea Fasano <afasano>
Installer sub component:	OpenShift on Bare Metal IPI	QA Contact:	Raviv Bar-Tal <rbartal>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	medium
Priority:	medium	CC:	augol, rbartal, stbenjam
Version:	4.5	Keywords:	Triaged
Target Milestone:	---
Target Release:	4.5.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:
Clones:	1815551 (view as bug list)		Environment:
Last Closed:	2020-08-04 18:06:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1815551

Description Andrea Fasano 2020-03-20 14:17:09 UTC

Description of problem: 
The test infra requires that /etc/passwd will be writable. The underlying issue is not a cve, it is trivial for any container launcher to gain control of /etc/passwd.  The baremetal image is intended for a wide range of uses and this use is deliberate until we have moved all test infra to a 4.x version.

Comment 2 Andrea Fasano 2020-03-24 12:13:13 UTC

Hi Raviv,
the change is required to allow the OpenShift CI (in particular baremetal ipi e2e test) to work properly. The baremetal-installer image is currently used by the CI job.

Thanks
Andrea

Comment 3 Raviv Bar-Tal 2020-03-24 13:16:14 UTC

Andrea Fasano help to verify this BZ, it is working for CI

Comment 6 errata-xmlrpc 2020-08-04 18:06:18 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.5 image release advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409