Description of problem: /var/log/neutron/ and all logs within it are world readable. These logs can contain sensitive information and should have access restricted as much as possible. Version-Release number of selected component (if applicable): openstack-neutron-2014.1.2-4.
Though I agree that we should limit access to log directory as much as possible, the issue is not Neutron specific, and is present in other components (I've checked Nova, Ceilometer; I expect other components to follow the example). So we need to determine how to properly handle that project wide.
(In reply to Ihar Hrachyshka from comment #1) > Though I agree that we should limit access to log directory as much as > possible, the issue is not Neutron specific, and is present in other > components (I've checked Nova, Ceilometer; I expect other components to > follow the example). So we need to determine how to properly handle that > project wide. Agreed, however the customer cited Neutron in the case thus the specific bug. Shall we create an overall tracker to audit the permissions of all openstack service logs and keep this one targeted at Neutron?
@Perry, I'm all for tracking the issue in all projects though I'm not the one to decide, clone and track all of them. As for puppet, I think the proper way is to make sure puppet modules do *not* touch any directories and rely on proper packaging. Yes, the clone for puppet-modules will also be needed to track that.
Have tested in Rhe7 openstack-neutron-2014.1.3-8.el7ost.noarch /var/log/neutron directory is chmod 750 drwxr-x---. 2 neutron neutron 4096 Nov 13 15:27 neutron
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2014-1938.html