harden kolla horzion usage of /tmp/

[Sven Kieske]

currently kolla-ansible bindmounts /tmp/ from the docker host (so usually the control-plane node) inside the container.

The Webapp itself runs as user horizon, but the Webserver (apache2) runs as root and is able to manipulate arbitrary files in private tmp dirs of services running inside other namespaces/containers on the host, including admin system services like systemd-logind:

dragon@ctl001:~$ docker exec -it --user=root horizon bash
(horizon)[root@ctl001 /]# cd /tmp/systemd-private-9dd6fe4987b6480e821f3e5a0333b4b7-systemd-logind.service-srLJIk/tmp/
(horizon)[root@ctl001 tmp]# touch pwned
(horizon)[root@ctl001 tmp]# ls -lashin
total 8.0K
2097732 4.0K drwxrwxrwt 2 0 0 4.0K Jun 5 07:55 .
2097731 4.0K drwx------ 3 0 0 4.0K Jun 5 07:50 ..
2097519 0 -rw-r--r-- 1 0 0 0 Jun 5 07:55 pwned
dragon@ctl001:~$ sudo su -
root@ctl001:~# ls -lashin /tmp/systemd-private-9dd6fe4987b6480e821f3e5a0333b4b7-systemd-logind.service-srLJIk/tmp
total 8.0K
2097732 4.0K drwxrwxrwt 2 0 0 4.0K Jun 5 07:55 .
2097731 4.0K drwx------ 3 0 0 4.0K Jun 5 07:50 ..
2097519 0 -rw-r--r-- 1 0 0 0 Jun 5 07:55 pwned

I'll provide a patch for that.

See also my downstream bug report at:

https://github.com/osism/issues/issues/1047

I found this bug when researching kolla-ansible for unsafe usage of /tmp/ directories.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/921371