Bug 1431479 - openstack-ironic: /var/log/ironic is world readable
Summary: openstack-ironic: /var/log/ironic is world readable
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-ironic
Version: 10.0 (Newton)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: z6
: 10.0 (Newton)
Assignee: Dmitry Tantsur
QA Contact: mlammon
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-03-13 00:46 UTC by Summer Long
Modified: 2017-11-15 13:48 UTC (History)
16 users (show)

Fixed In Version: openstack-ironic-6.2.4-2.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Originally, the /var/log/ironic was readable to all users. The problem has been fixed. As a result, only the owner and the group members have read access to the directory.
Clone Of: 1431468
: 1431480 1431483 (view as bug list)
Environment:
Last Closed: 2017-11-15 13:48:19 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:3235 normal SHIPPED_LIVE openstack-ironic bug fix advisory 2017-11-15 18:37:37 UTC
RDO 9683 None None None 2017-09-19 17:53:14 UTC

Description Summer Long 2017-03-13 00:46:27 UTC
Description of problem:
The directory /var/log/ironic is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/ironic directory.

Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw.

Version-Release number of selected component (if applicable):
openstack-ironic-6.2.2-3.el7ost

How reproducible:
List /var/log directory for openstack-ironic:
$ ls -la ironic
total 28832
drwxr-xr-x.  3 ironic ironic     4096 Mar 12 03:20 .
drwxr-xr-x. 31 root   root       4096 Mar  5 18:23 ..
drwxr-xr-x.  2 ironic ironic     4096 Feb 17 00:05 deploy
-rw-r--r--.  1 ironic ironic  1524729 Mar 12 20:12 ironic-api.log
-rw-r--r--.  1 ironic ironic  1976765 Mar 10 03:28 ironic-api.log-20170310.gz
-rw-r--r--.  1 ironic ironic 16423530 Mar 12 20:12 ironic-conductor.log
-rw-r--r--.  1 ironic ironic   717400 Feb 24 03:47 ironic-conductor.log-20170224.gz
-rw-r--r--.  1 root   root          0 Feb 16 22:44 ironic-dbsync.log

Actual results:
Directory and files are world readable.

Expected results:
Directory and files should not be world readable.

Comment 1 Dmitry Tantsur 2017-04-25 09:55:37 UTC
Derek, mind proposing a backport of https://review.rdoproject.org/r/#/c/5258/ please?

Comment 2 Bob Fournier 2017-10-31 13:26:51 UTC
It appears that https://review.rdoproject.org/r/#/c/5258/ has merged so moving this to POST.  Need to track down whether this is in a z release.

Comment 6 mlammon 2017-11-01 16:43:37 UTC
installed latest osp10 with puddle 2017-10-30.3 on 11/1/2017
This bug has been verified

environment:
openstack-ironic-api-6.2.4-2.el7ost.noarch
openstack-ironic-conductor-6.2.4-2.el7ost.noarch
openstack-ironic-common-6.2.4-2.el7ost.noarch
openstack-ironic-inspector-4.2.2-3.el7ost.noarch

[stack@undercloud ~]$ sudo ls -la /var/log/ironic
total 836
drwxr-x---.  2 ironic ironic     81 Oct 20 17:10 .
drwxr-xr-x. 30 root   root     4096 Oct 20 17:02 ..
-rw-r--r--.  1 ironic ironic 187066 Oct 20 18:33 ironic-api.log
-rw-r--r--.  1 ironic ironic 435477 Oct 20 18:34 ironic-conductor.log
-rw-r--r--.  1 ironic ironic      0 Oct 20 17:03 ironic-dbsync.log

Comment 9 errata-xmlrpc 2017-11-15 13:48:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:3235


Note You need to log in before you can comment on or make changes to this bug.