Symlink attack with signing_dir = /tmp/keystone-signing-nova

[Thomas Goirand]

Hi,

Having such thing in the default configuration file:

signing_dir = /tmp/keystone-signing-nova

was the origin of a CVE in Nova. I would strongly suggest to not use known filenames in /tmp, which are vectors of symlink attacks (and no, the kernel in Wheezy and Precise doesn't have the feature to stop it, that's only in 3.8, IIRC).

The best way to fix it is to use something in the home folder of the package, for example in /var/lib/trove.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/49276

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/49276
Committed: http://github.com/openstack/trove/commit/0805d0a00848fbbb6c719ab484792796c930a33b
Submitter: Jenkins
Branch: master

commit 0805d0a00848fbbb6c719ab484792796c930a33b
Author: Michael Basnight <email address hidden>
Date: Tue Oct 1 15:10:22 2013 -0700

    fixing symlink attack bug present in the application.

    fixes bug 1233305

    Change-Id: I14a94b3b5cb27e8d6c5848c212b3b88053aa8aca

[Thierry Carrez (ttx)]

RC2 window opened, feel free to backport to milestone-proposed

[Michael Basnight (hubcap)]

Thx dude.

Sent from my digital shackles

> On Oct 2, 2013, at 5:03 AM, Thierry Carrez <email address hidden> wrote:
>
> RC2 window opened, feel free to backport to milestone-proposed
>
> ** Changed in: trove
> Milestone: None => havana-rc2
>
> --
> You received this bug notification because you are a bug assignee.
> https://bugs.launchpad.net/bugs/1233305
>
> Title:
> Symlink attack with signing_dir = /tmp/keystone-signing-nova
>
> Status in Trove - Database as a Service:
> Fix Committed
>
> Bug description:
> Hi,
>
> Having such thing in the default configuration file:
>
> signing_dir = /tmp/keystone-signing-nova
>
> was the origin of a CVE in Nova. I would strongly suggest to not use
> known filenames in /tmp, which are vectors of symlink attacks (and no,
> the kernel in Wheezy and Precise doesn't have the feature to stop it,
> that's only in 3.8, IIRC).
>
> The best way to fix it is to use something in the home folder of the
> package, for example in /var/lib/trove.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/trove/+bug/1233305/+subscriptions

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: milestone-proposed
Review: https://review.openstack.org/49390

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/49390
Committed: http://github.com/openstack/trove/commit/55cefeac636a235f808d940518ad50aad3e701e0
Submitter: Jenkins
Branch: milestone-proposed

commit 55cefeac636a235f808d940518ad50aad3e701e0
Author: Michael Basnight <email address hidden>
Date: Tue Oct 1 15:10:22 2013 -0700

    fixing symlink attack bug present in the application.

    fixes bug 1233305

    Change-Id: I14a94b3b5cb27e8d6c5848c212b3b88053aa8aca
    (cherry picked from commit 0805d0a00848fbbb6c719ab484792796c930a33b)