Bug 1431484 – openstack-ironic-inspector: /var/log/ironic-inspector is world readable

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1431484 - openstack-ironic-inspector: /var/log/ironic-inspector is world readable

Summary:	openstack-ironic-inspector: /var/log/ironic-inspector is world readable

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	openstack-ironic-inspector (Show other bugs)
Sub Component:
Version:	11.0 (Ocata)
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	11.0 (Ocata)
Assigned To:	Dmitry Tantsur
QA Contact:	Alexander Chuzhoy
Docs Contact:

URL:
Whiteboard:
Keywords:	Security, Triaged

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-03-12 21:10 EDT by Summer Long
Modified:	2017-05-17 16:06 EDT (History)
CC List:	16 users (show)

See Also:
Fixed In Version:	openstack-ironic-inspector-5.0.0-2.el7ost
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:	1431483
Clones:	1431485 (view as bug list)
Environment:
Last Closed:	2017-05-17 16:06:55 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHEA-2017:1245	normal	SHIPPED_LIVE	Red Hat OpenStack Platform 11.0 Bug Fix and Enhancement Advisory	2017-05-17 19:01:50 EDT

Groups: None (edit)

Description Summer Long 2017-03-12 21:10:10 EDT

Description of problem:
The directory /var/log/ironic-inspector is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/ironic directory.

Because no sensitive data was found in the files, this is being raised as a hardening bug, and not a flaw.

Version-Release number of selected component (if applicable):
openstack-ironic-inspector-5.0.1-0.20170214181727.babc2b6.el7ost

Comment 1 Dmitry Tantsur 2017-03-13 05:28:15 EDT

RDO master patch: https://review.rdoproject.org/r/#/c/5786/

Comment 2 Dmitry Tantsur 2017-03-13 08:33:24 EDT

Fix merged in RDO: https://review.rdoproject.org/r/#/c/5792/

Comment 4 Alexander Chuzhoy 2017-03-20 10:27:07 EDT

verified:
Environment:
openstack-ironic-inspector-5.0.0-2.el7ost.noarch



[root@undercloud-0 ~]# ls -la /var/log/ironic-inspector/ -d                                                                                                                                   
drwxr-x---. 3 ironic-inspector ironic-inspector 4096 Mar 20 03:40 /var/log/ironic-inspector/

Comment 6 errata-xmlrpc 2017-05-17 16:06:55 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1245

Note You need to log in before you can comment on or make changes to this bug.