Description of problem: The file /etc/openstack-dashboard/local_settings contains some security values which should not be publicly disclosed like the SECRET_KEY. According to the documentation of Django, this value should remain secret : https://docs.djangoproject.com/en/dev/ref/settings/#secret-key Version-Release number of selected component (if applicable): openstack-packstack-2014.2-0.16.dev1401.gdd19d48.el7ost.noarch openstack-dashboard-2014.2.2-2.el7ost.noarch How reproducible: Installing Openstack Horizon using Packstack Steps to Reproduce: 1. Install Packstack 2. Install Openstack Horizon using Packstack Actual results: The file /etc/openstack-dashboard/local_settings gets mode 644 Expected results: The file's mode should be 640 to preserve its content Additional info: Log message from horizon.pp Notice: /Stage[main]/Horizon/File[/etc/openstack-dashboard/local_settings]/mode: mode changed '0640' to '0644'
Can i have qa and pm acks please?
Verified ======== openstack-packstack-2015.1-0.15.dev1589.g1d6372f.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-0265.html
The security fix has been sent to the upstream puppet-horizon module that Packstack consumes [1]. Once the patch lands there, we will revert the fix in Packstack [2] as it will no longer be necessary. [1]: https://review.openstack.org/#/c/294823/ [2]: https://review.openstack.org/#/c/294825/
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days