admin-openrc.sh is world readable

[Mark Goddard]

The kolla-ansible post-deploy command creates a file called admin-openrc.sh in same directory as globals.yml (/etc/kolla by default) on localhost. This script exports environment variables which may be used to access the cloud as the admin user in the admin project, and as such is very sensitive.

Currently, the task that creates the file does so with become=true, and without specifying a mode:

- name: Creating admin openrc file on the deploy node
  hosts: localhost
  become: true
  tasks:
    - name: Template out admin-openrc.sh
      template:
        src: "roles/common/templates/admin-openrc.sh.j2"
        dest: "{{ node_config }}/admin-openrc.sh"

With ansible!=2.9.12,!=2.8.14 this results in a file with the following permission and ownership:

-rw-r--r--. 1 root root 549 Aug 14 16:28 /etc/kolla/admin-openrc.sh

NOTE: Ansible in 2.9.12 and 2.8.14 introduced a change to the default mode, making it 600 (see https://bugs.launchpad.net/kolla-ansible/+bug/1891145). This may be reverted, TBC.

This means that any user with access to the directory containing the file will be able to read it, and hence the cloud's admin credentials. In many cases the directory permissions should prevent this, but we cannot rely on it.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/745071
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=16f97867a3f7050ac42fbb921310ca884e974a11
Submitter: Zuul
Branch: master

commit 16f97867a3f7050ac42fbb921310ca884e974a11
Author: likui <email address hidden>
Date: Thu Aug 6 14:12:44 2020 +0800

    Fix ownership and permissions of admin-openrc.sh

    Previously the post-deploy.yml playbook was executed with become: true,
    and the admin-openrc.sh file templated without an owner or mode
    specified. This resulted in admin-openrc.sh being owned by root with 644
    permissions.

    This change creates the file without become: true, and explicitly sets
    the owner to the user executing Ansible, and the mode to 600.

    Co-Authored-By: Mark Goddard <email address hidden>

    Closes-Bug: #1891704

    Change-Id: Iadf43383a7f2bf377d4666a55a38d92bd70711aa

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/747016

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/747424

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/747426

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/747426
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=7f2b169627d7a936da182b4128ac34e6d5bece6d
Submitter: Zuul
Branch: stable/stein

commit 7f2b169627d7a936da182b4128ac34e6d5bece6d
Author: likui <email address hidden>
Date: Thu Aug 6 14:12:44 2020 +0800

    Fix ownership and permissions of admin-openrc.sh

    Previously the post-deploy.yml playbook was executed with become: true,
    and the admin-openrc.sh file templated without an owner or mode
    specified. This resulted in admin-openrc.sh being owned by root with 644
    permissions.

    This change creates the file without become: true, and explicitly sets
    the owner to the user executing Ansible, and the mode to 600.

    Co-Authored-By: Mark Goddard <email address hidden>

    Closes-Bug: #1891704

    Change-Id: Iadf43383a7f2bf377d4666a55a38d92bd70711aa
    (cherry picked from commit 16f97867a3f7050ac42fbb921310ca884e974a11)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/747424
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=27919beeedac0a99aecc85a7dacb2115451cd09b
Submitter: Zuul
Branch: stable/train

commit 27919beeedac0a99aecc85a7dacb2115451cd09b
Author: likui <email address hidden>
Date: Thu Aug 6 14:12:44 2020 +0800

    Fix ownership and permissions of admin-openrc.sh

    Previously the post-deploy.yml playbook was executed with become: true,
    and the admin-openrc.sh file templated without an owner or mode
    specified. This resulted in admin-openrc.sh being owned by root with 644
    permissions.

    This change creates the file without become: true, and explicitly sets
    the owner to the user executing Ansible, and the mode to 600.

    Co-Authored-By: Mark Goddard <email address hidden>

    Closes-Bug: #1891704

    Change-Id: Iadf43383a7f2bf377d4666a55a38d92bd70711aa
    (cherry picked from commit 16f97867a3f7050ac42fbb921310ca884e974a11)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/747016
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=29574271828528f1c0e0fd887efa07631be4a355
Submitter: Zuul
Branch: stable/ussuri

commit 29574271828528f1c0e0fd887efa07631be4a355
Author: likui <email address hidden>
Date: Thu Aug 6 14:12:44 2020 +0800

    Fix ownership and permissions of admin-openrc.sh

    Previously the post-deploy.yml playbook was executed with become: true,
    and the admin-openrc.sh file templated without an owner or mode
    specified. This resulted in admin-openrc.sh being owned by root with 644
    permissions.

    This change creates the file without become: true, and explicitly sets
    the owner to the user executing Ansible, and the mode to 600.

    Co-Authored-By: Mark Goddard <email address hidden>

    Closes-Bug: #1891704

    Change-Id: Iadf43383a7f2bf377d4666a55a38d92bd70711aa
    (cherry picked from commit 16f97867a3f7050ac42fbb921310ca884e974a11)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 8.3.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 10.2.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 9.3.0 release.