Bug 1163420 – Adjust log permissions to 0750 for openstack-sahara

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1163420 - Adjust log permissions to 0750 for openstack-sahara

Summary:	Adjust log permissions to 0750 for openstack-sahara

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	openstack-sahara (Show other bugs)
Sub Component:
Version:	5.0 (RHEL 7)
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	z4
Target Release:	5.0 (RHEL 7)
Assigned To:	Elise Gafford
QA Contact:	Luigi Toscano
Docs Contact:

URL:
Whiteboard:
Keywords:	EasyFix, ZStream

Depends On:
Blocks:	1163424
	Show dependency tree / graph

Reported:	2014-11-12 11:42 EST by Lon Hohberger
Modified:	2015-04-16 10:37 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:	openstack-sahara-2014.1.3-2.el7ost
Doc Type:	Bug Fix
Doc Text:	Previously, the log directory permissions for Sahara was set to 755, resulting in the Sahara service not conforming to the Red Hat log security standards. With this update, the directory permissions are modified to 750, thus, conforming to the Red Hat log security standards.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-04-16 10:37:38 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2015:0825	normal	SHIPPED_LIVE	Red Hat Enterprise Linux OpenStack Platform Bug Fix and Enhancement Advisory	2015-04-16 14:28:14 EDT

Groups: None (edit)

Description Lon Hohberger 2014-11-12 11:42:29 EST

The spec file for openstack-sahara sets the permissions for /var/log/sahara directory to 0755, which is world-readable.  To maintain consistency, please set this to 0750.  See bug 1149688 for more details.  In the RPM spec file in the %files section, you can use the following:

%dir %attr(0750, sahara, sahara) %{_localstatedir}/log/sahara

(Owner/Group are examples and may be different for this component)

Comment 1 Lon Hohberger 2014-11-12 11:51:02 EST

The intent here is to tighten up access on /var/log directories and files.  Note that, apart from the RPM spec files, it's possible some OpenStack components may be setting permissions incorrectly as well.

It also may be the case that this component has a valid need to have its /var/log directory world-readable.  If that is the case, please close this bugzilla.

Comment 3 Luigi Toscano 2015-04-03 10:46:26 EDT

The permissions of a freshly installed /var/log/sahara are 0750, thanks to the change in the RPM file.
Verified on openstack-sahara-2014.1.3-3.el7ost.noarch

Comment 5 errata-xmlrpc 2015-04-16 10:37:38 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0825.html

Note You need to log in before you can comment on or make changes to this bug.