Bug 1431483 - openstack-ironic-inspector: /var/log/ironic-inspector is world readable
Summary: openstack-ironic-inspector: /var/log/ironic-inspector is world readable
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-ironic-inspector
Version: 10.0 (Newton)
Hardware: Unspecified
OS: Unspecified
Target Milestone: z4
: 10.0 (Newton)
Assignee: Dmitry Tantsur
QA Contact: Raviv Bar-Tal
Depends On:
TreeView+ depends on / blocked
Reported: 2017-03-13 01:03 UTC by Summer Long
Modified: 2017-09-06 17:16 UTC (History)
15 users (show)

Fixed In Version: openstack-ironic-inspector-4.2.2-3.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1431479
: 1431484 (view as bug list)
Last Closed: 2017-09-06 17:16:25 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2659 normal SHIPPED_LIVE openstack-ironic bug fix advisory 2017-09-06 20:57:53 UTC
RDO 5793 None None None 2017-03-13 13:13:01 UTC

Description Summer Long 2017-03-13 01:03:38 UTC
Description of problem:
The directory /var/log/ironic-inspector is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/ironic directory.

Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw.

Version-Release number of selected component (if applicable):

How reproducible:
List /var/log directory for openstack-ironic-inspector:
$ ls -la ironic-inspector
total 7936
drwxr-xr-x.  3 ironic-inspector ironic-inspector    4096 Mar 10 03:29 .
drwxr-xr-x. 31 root             root                4096 Mar  5 18:23 ..
-rw-r--r--.  1 ironic-inspector ironic-inspector 6789347 Mar 12 21:00 ironic-inspector.log
-rw-r--r--.  1 ironic-inspector ironic-inspector  317198 Feb 21 03:27 ironic-inspector.log-20170221.gz
-rw-r--r--.  1 ironic-inspector ironic-inspector  354698 Feb 26 03:34 ironic-inspector.log-20170226.gz
-rw-r--r--.  1 ironic-inspector ironic-inspector  331045 Mar  5 18:22 ironic-inspector.log-20170305.gz
-rw-r--r--.  1 ironic-inspector ironic-inspector  309486 Mar 10 03:28 ironic-inspector.log-20170310.gz
drwxr-xr-x.  2 ironic-inspector ironic-inspector    4096 Jan 13 12:38 ramdisk

Actual results:
Directory and files are world readable.

Expected results:
Directory and files should not be world readable.

Comment 1 Dmitry Tantsur 2017-03-13 12:34:03 UTC
Fix merged in RDO: https://review.rdoproject.org/r/#/c/5793/

Comment 4 Bob Fournier 2017-08-17 21:45:14 UTC
Verified in openstack-ironic-inspector-4.2.2-3.el7ost.noarch

drwxr-x---.  3 ironic-inspector ironic-inspector      49 Aug 17 17:21 ironic-inspector

[stack@host06 log]$ ls -al ironic-inspector
ls: cannot open directory ironic-inspector: Permission denied

Comment 7 errata-xmlrpc 2017-09-06 17:16:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.