Bug 1431464 - openstack-gnocchi: /var/log/gnocchi is world readable
Summary: openstack-gnocchi: /var/log/gnocchi is world readable
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-gnocchi
Version: 9.0 (Mitaka)
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: 11.0 (Ocata)
Assignee: Pradeep Kilambi
QA Contact: Sasha Smolyak
Depends On:
TreeView+ depends on / blocked
Reported: 2017-03-12 23:31 UTC by Summer Long
Modified: 2017-05-17 20:06 UTC (History)
7 users (show)

Fixed In Version: openstack-gnocchi-3.1.2-1.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1431462
: 1431465 (view as bug list)
Last Closed: 2017-05-17 20:06:46 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
RDO 5257 0 None None None 2017-03-13 13:02:46 UTC
RDO 5799 0 None None None 2017-03-13 13:03:24 UTC
Red Hat Product Errata RHEA-2017:1245 0 normal SHIPPED_LIVE Red Hat OpenStack Platform 11.0 Bug Fix and Enhancement Advisory 2017-05-17 23:01:50 UTC

Description Summer Long 2017-03-12 23:31:58 UTC
Description of problem:
The directory /var/log/gnocchi is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/gnocchi directory.

Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw.

Version-Release number of selected component (if applicable):

How reproducible:
List /var/log directory for openstack-gnocchi:
$  ls -la gnocchi
total 72
drwxr-xr-x.  2 gnocchi root       67 Mar  7 20:25 .
drwxr-xr-x. 29 root    root     4096 Mar 12 19:20 ..
-rw-r--r--.  1 gnocchi gnocchi   322 Mar  7 20:25 gnocchi-upgrade.log
-rw-r--r--.  1 gnocchi gnocchi 26511 Mar 12 19:23 metricd.log
-rw-r--r--.  1 gnocchi gnocchi 29540 Mar 12 19:21 statsd.log

Actual results:
Directory and files are world readable.

Expected results:
Directory and files should not be world readable.

Comment 1 Pradeep Kilambi 2017-03-13 13:02:46 UTC
this has been fixed in master rdo already. I backported to ocata.

Comment 4 Sasha Smolyak 2017-04-25 11:38:19 UTC
[stack@undercloud-0 log]$ ls -la gnocchi
ls: cannot open directory gnocchi: Permission denied
[stack@undercloud-0 log]$ ls -lart gnocchi
ls: cannot open directory gnocchi: Permission denied
[stack@undercloud-0 log]$ sudo ls -lart gnocchi
total 24
-rw-r--r--.  1 gnocchi gnocchi 1090 Apr 25 06:28 gnocchi-upgrade.log
-rw-r--r--.  1 gnocchi gnocchi  611 Apr 25 06:28 statsd.log
drwxr-x---.  2 gnocchi root      85 Apr 25 06:31 .
-rw-r--r--.  1 gnocchi gnocchi 2683 Apr 25 06:31 app.log
drwxr-xr-x. 34 root    root    4096 Apr 25 07:09 ..
-rw-r--r--.  1 gnocchi gnocchi 4415 Apr 25 07:34 metricd.log

Comment 5 errata-xmlrpc 2017-05-17 20:06:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.