ceilometer charm creates world-readable /etc/ceilometer/ceilometer.conf, exposing credentials

Bug #1588391 reported by Paul Gear on 2016-06-02
272
This bug affects 4 people
Affects Status Importance Assigned to Milestone
OpenStack ceilometer charm
High
Liam Young
Ubuntu Cloud Archive
High
Corey Bryant
ceilometer (Juju Charms Collection)
High
Liam Young
ceilometer (Ubuntu)
High
Corey Bryant

Bug Description

On a newly-installed system using ceilometer from the charm store, /etc/ceilometer/ceilometer.conf is world-readable, despite holding a number of important credentials:

ubuntu@juju-machine-131-lxc-2:/etc/ceilometer$ ls -la /etc/ceilometer/ceilometer.conf
-rw-r--r-- 1 ceilometer ceilometer 1140 Jun 2 14:12 /etc/ceilometer/ceilometer.conf

Permissions should be changed to 0640 at a maximum.

Paul Gear (paulgear) on 2016-06-02
description: updated
Ryan Beisner (1chb1n) on 2016-09-22
affects: charms → ceilometer (Juju Charms Collection)
Liam Young (gnuoy) on 2017-02-02
Changed in ceilometer (Juju Charms Collection):
status: New → Confirmed
importance: Undecided → High
assignee: nobody → Liam Young (gnuoy)
milestone: none → 17.01
Liam Young (gnuoy) wrote :

I think it's the /etc/ceilometer directory which should be 750 rather than 755

Chuck Short (zulcss) wrote :

Set to 0700 as the other packages.

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ceilometer (Ubuntu):
status: New → Confirmed
Xav Paice (xavpaice) on 2017-02-08
tags: added: canonical-bootstack
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ceilometer - 1:8.0.0-0ubuntu5

---------------
ceilometer (1:8.0.0-0ubuntu5) zesty; urgency=medium

  * debian/control: Really fix adjustements.

 -- Chuck Short <email address hidden> Fri, 10 Feb 2017 10:06:55 -0500

Changed in ceilometer (Ubuntu):
status: Confirmed → Fix Released
James Page (james-page) on 2017-02-23
Changed in charm-ceilometer:
assignee: nobody → Liam Young (gnuoy)
importance: Undecided → High
status: New → Confirmed
Changed in ceilometer (Juju Charms Collection):
status: Confirmed → Invalid
Corey Bryant (corey.bryant) wrote :

This particular issue wasn't actually fixed in the ceilometer package, so moving back to in progress.

Changed in ceilometer (Ubuntu):
status: Fix Released → Triaged
status: Triaged → In Progress
Corey Bryant (corey.bryant) wrote :

I've pushed the fix for this to https://code.launchpad.net/~ubuntu-server-dev/ubuntu/+source/ceilometer/+git/ceilometer.

However, I attempted to upload the package but it was rejected because there is now an 8.0.1 version of ceilometer in zesty, which wasn't pushed to the git repo, so now the git repo is out of sync.

Chuck, I'm leaving this for you to fix up.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ceilometer - 1:8.0.1-0ubuntu2

---------------
ceilometer (1:8.0.1-0ubuntu2) zesty; urgency=medium

  * d/ceilometer-commmon.postinst: Set permissions to 0640 for
    /etc/ceilometer/ceilometer.conf (LP: #1588391).

 -- Corey Bryant <email address hidden> Thu, 16 Mar 2017 10:19:40 -0400

Changed in ceilometer (Ubuntu):
status: In Progress → Fix Released
Corey Bryant (corey.bryant) wrote :

This is fixed now in the ceilometer package which is currently in zesty-proposed and xenial-staging. I've tested with the charm and ceilometer.conf perms remain at 0640.

-rw-r----- 1 ceilometer ceilometer 590 Mar 16 15:47 ceilometer.conf

Changed in charm-ceilometer:
status: Confirmed → Invalid
Changed in cloud-archive:
importance: Undecided → High
Changed in ceilometer (Ubuntu):
importance: Undecided → High
Changed in cloud-archive:
assignee: nobody → Corey Bryant (corey.bryant)
Changed in ceilometer (Ubuntu):
assignee: nobody → Corey Bryant (corey.bryant)
Changed in cloud-archive:
status: New → Fix Committed
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers