openstack-tripleo-common: sudoers file is too permissive

[Toure Dunnon]

The sudoers files as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal with ".." and it grants full passwordless root access to the validations user.

[Ben Nemec (bnemec)]

I think we need to add a validations person to this bug to determine whether this will work. I suspect it may break some of the validations.

[Florian Fuchs (flo-fuchs)]

The permissions are needed in order to let validations use Ansible's "become" flag, which runs commands as root. Currently 18 out of the 26 validations use that flag, for all kinds of tasks like reading config files, call hiera, get service statuses etc.

IIUC accepting the proposed patch would make these validations break. So we need to find a viable way to recognize the commands run as sudo in the current validations in the sudoers file (which potentially isn't so easy to identify, because some of them are called through builtin Ansible modules). Also, if we restrict what the validations user can do, we need to document this so authors of future validations know about the restrictions (and can suggest allowing further commands in the sudoers file if needed).

I can't think of something better right now. Ideas?

[Florian Fuchs (flo-fuchs)]

This bug seems to have been re-opened in a separate report: https://bugs.launchpad.net/tripleo/+bug/1705709

The related commit has been merged, which breaks validations when run through mistral/UI (Details: https://bugs.launchpad.net/tripleo/+bug/1716625)

[Emilien Macchi (emilienm)]

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (FUTURE, PIKE, QUEENS, ROCKY, STEIN).
  Valid example: CONFIRMED FOR: FUTURE