[Bug 1675088] Re: Restrict permissions on Openstack installation
Corey Bryant
corey.bryant at canonical.com
Fri May 11 18:00:35 UTC 2018
Testing has completed successfully for glance in ocata-proposed:
root at x1:~# ls -al /etc/glance/
total 28
drwxr-x--- 3 root glance 4096 May 11 17:49 .
And ocata-proposed regression tests passed:
======
Totals
======
Ran: 102 tests in 1806.1829 sec.
- Passed: 94
- Skipped: 8
- Expected Fail: 0
- Unexpected Success: 0
- Failed: 0
Sum of execute time for each test: 1104.3589 sec.
** Tags removed: verification-ocata-needed
** Tags added: verification-ocata-done
--
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to heat in Ubuntu.
https://bugs.launchpad.net/bugs/1675088
Title:
Restrict permissions on Openstack installation
Status in Ubuntu Cloud Archive:
Triaged
Status in Ubuntu Cloud Archive ocata series:
Fix Committed
Status in Ubuntu Cloud Archive pike series:
Fix Released
Status in heat package in Ubuntu:
Fix Released
Status in horizon package in Ubuntu:
Fix Released
Status in heat source package in Zesty:
Fix Released
Status in horizon source package in Zesty:
Won't Fix
Status in heat source package in Artful:
Fix Released
Status in horizon source package in Artful:
Fix Released
Bug description:
[Impact]
Default configuration file permissions may allow read by unprivileged users other than the package system account.
[Test Case]
sudo apt install <pkg>-common
ls -l /etc/<pkg>
a) folder may be readable b) files may be readable
[Regression Potential]
Medium; if a openstack daemon can't read its config files, it won't startup; however most packages are covered by DEP-8 tests and we'll test
a full OpenStack deployment using the normal SRU testing process:
https://wiki.ubuntu.com/OpenStack/StableReleaseUpdates
[Original Bug Report]
Example given by CPE:
Permssions for /etc/openstack-dashboard/ are too loose (755). Should be 700, horizon:horizon
Permssions for /etc/cinder/ are too loose (750). Should be 700, cinder:cinder
Permssions for /etc/glance/ are too loose (755). Should be 700, glance:glance
Permssions for /etc/heat/ are too loose (750). Should be 700, heat:heat
Permssions for /etc/ceilometer/ are too loose (755). Should be 700, ceilometer:ceilometer
Will leave for you to evaluate best permissions.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1675088/+subscriptions
More information about the Ubuntu-openstack-bugs
mailing list