This as an RDO Project security tracking bug against openstack-mistral. It was created to ensure that one or more security vulnerabilities are fixed. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. [bug automatically created by: add-tracking-bugs]
Fix proposed: https://review.rdoproject.org/r/5251
proposed for newton-rdo https://review.rdoproject.org/r/#/c/5614
proposed for mitaka-rdo https://review.rdoproject.org/r/#/c/5615
proposed backport for ocata-rdo https://review.rdoproject.org/r/5616
Copying my comment from (already merged) gerrit review https://review.rdoproject.org/r/#/c/5251/ for increased visibility, as I didn't get any response there: It is unclear from the description which specific "sensitive information" is leaked so I'm not sure proposed fix is correct: logs should not contain sensitive info and bugfix should be to conceal it before sending to logs like for example password parameters in oslo.config: https://github.com/openstack/oslo.config/commit/0e4f86ec0998779b1ef4a1ae72a985d823886ff4 The plan is to centralize logs collection using Opstools SIG and removing log readability might break fluentd agent.
According to the corresponding upstream bug ( https://bugs.launchpad.net/mistral/+bug/1337268 ), any workflow's inputs are written to INFO logs, including sensitive parameters such as passwords. A more robust fix to identify and mask sensitive inputs is still being discussed upstream, until then I think we could close that report.
Regarding the fluentd agent, shouldn't it be a member of the mistral group instead of having logs world-readable ?
fluentd agent is currently run as root user. That shouldn't be a problem.