Description of problem: The directory /var/log/ironic is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/ironic directory. Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw. Version-Release number of selected component (if applicable): openstack-ironic-5.1.2-3.el7ost How reproducible: List /var/log directory for openstack-ironic: $ ls -la ironic total 1292 drwxr-xr-x. 2 ironic ironic 78 Mar 7 22:58 . drwxr-xr-x. 29 root root 4096 Mar 12 19:20 .. -rw-r--r--. 1 ironic ironic 361530 Mar 12 19:23 ironic-api.log -rw-r--r--. 1 ironic ironic 656283 Mar 12 19:22 ironic-conductor.log -rw-r--r--. 1 root root 0 Mar 7 20:04 ironic-dbsync.log Actual results: Directory and files are world readable. Expected results: Directory and files should not be world readable.
Derek, mind proposing a backport of https://review.rdoproject.org/r/#/c/5258/ please?
Derek - regarding the "Fixed In Version" - I don't see openstack-ironic-5.1.3-2 in brew and the latest 9z release has openstack-ironic-5.1.3-1.
Sorry, I had updated the packaging but not built it, I've built it now openstack-ironic-5.1.3-2.el7ost
Installed latest rhos 9 2018-08-23.1 [stack@undercloud-0 ~]$ ll /var/log | grep ironic drwxr-x---. 2 ironic ironic 6 Apr 17 09:43 ironic [stack@undercloud-0 ~]$ cat core_puddle_version 2018-08-23.1[stack@undercloud-0 ~]$ less /etc/yum.repos.d/ latest-installed rhos-release-9-director.repo rhos-release-ceph-1.3.repo rhos-release.repo mirror-readme rhos-release-9.repo rhos-release-ceph-osd-1.3.repo rhos-release-rhel-7.5.repo environment [stack@undercloud-0 ~]$ rpm -qa | grep openstack-ironic openstack-ironic-inspector-3.2.2-4.el7ost.noarch openstack-ironic-common-5.1.3-2.el7ost.noarch openstack-ironic-api-5.1.3-2.el7ost.noarch openstack-ironic-conductor-5.1.3-2.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:2854