Cinder Huawei driver sets insecure permissions

[Dirk Mueller]

the Huawei driver sets 777 permissions as root on some files:

./cinder/volume/drivers/huawei/ssh_common.py: utils.execute('chmod', '777', filepath, run_as_root=True)
./cinder/volume/drivers/huawei/rest_common.py: utils.execute('chmod', '777', filepath, run_as_root=True)

[Thierry Carrez (ttx)]

NB: This was probably public for a minute.

[Thierry Carrez (ttx)]

Sounds legit, unless those backends actually rely on 666/777 files to work properly (!?)
Probably needs a common OSSA with bug 1260679.

[John Griffith (john-griffith)]

Checking with the driver maintainers on both of these to see if this is a requirement or not. I'd say it's a valid security issue, but I'll need input from IBM and Huawei in terms of their capabilities and what our options are here.

[Thierry Carrez (ttx)]

@John: if you confirmed that it's not a requirement, could you fix it in the same patch as the GPFS one ? Just post it on the other bug.

[Brian Rosmaita (brian-rosmaita)]

The bug this is a duplicate of was made public on 2014-02-10. Additionally, the vulnerability was in Icehouse and earlier; Icehouse went EOL on 2015-07-02. So no sense keeping this as a private security bug.