The directory /var/log/mistral is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/mistral directory:
[stack@instack ~]$ ls -la /var/log/mistral
drwxr-xr-x. 2 mistral mistral 4096 Feb 9 01:07 .
drwxr-xr-x. 31 root root 4096 Feb 9 01:02 ..
-rw-r--r--. 1 mistral mistral 112623 Feb 9 20:09 api.log
-rw-r--r--. 1 mistral mistral 1829883 Feb 9 20:09 engine.log
-rw-r--r--. 1 mistral mistral 383889 Feb 9 20:09 executor.log
Name: Hans Feldt (Ericsson)
Created openstack-mistral tracking bugs for this issue:
Affects: openstack-rdo [bug 1422267]
This issue has been addressed in the following products:
Red Hat OpenStack Platform 10.0 (Newton)
Via RHSA-2017:1584 https://access.redhat.com/errata/RHSA-2017:1584
While this has been resolved in Mistral, I noticed that when debug logging is enabled heatclient does log the passwords. They then show up in the Mistral logs. Is this something we need to look into or can we ignore DEBUG messages?
(In reply to Dougal Matthews from comment #6)
> While this has been resolved in Mistral, I noticed that when debug logging
> is enabled heatclient does log the passwords. They then show up in the
> Mistral logs. Is this something we need to look into or can we ignore DEBUG
Apologise. This wording is a bit confusing. I realise this CVE is specific to the logs being world readable. I have put in some time to mask the passwords in Mistral logs, so they are now replaced with *** in the logs. This work has merged upstream in master, train, stein and rocky. This seems to be working well with the exception of logging done by heatclient which does a DEBUG log of the passwords. Is this something we can consider okay or should we look into it? I believe we don't recommend running with debug logging normally.
Hi Dougal, this is the older CVE. The one matching the bug: https://bugs.launchpad.net/tripleo/+bug/1850843
is here: https://bugzilla.redhat.com/show_bug.cgi?id=1768731
DEBUG logging will only be a hardening issue if the regression to world-readable has been fixed.
Thanks, sorry, I got confused. I'll move to the correct BZ.