Cinder's rootwrap filters allow to run find as root, which allows arbitrary commands
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Cinder |
Fix Released
|
Undecided
|
Daniel Gollub | ||
OpenStack Security Advisory |
Invalid
|
Undecided
|
Unassigned | ||
oslo-incubator |
Invalid
|
Undecided
|
Unassigned |
Bug Description
The patch https:/
vagrant@
cinder@
uid=109(cinder) gid=115(cinder) groups=115(cinder)
cinder@
root@controller:~# id
uid=0(root) gid=0(root) groups=0(root)
I guess the way to fix this is to add a FindFilter to Oslo that rejects calls to find with the -exec or -execdir argument.
Changed in cinder: | |
assignee: | nobody → Daniel Gollub (d-gollub) |
status: | New → Confirmed |
Changed in cinder: | |
milestone: | none → icehouse-3 |
status: | Fix Committed → Fix Released |
Changed in cinder: | |
milestone: | icehouse-3 → 2014.1 |
John/Doug, thoughts on how and where we want to mitigate this initially? Patch rootwrap in Cinder first, then replicate that change to Oslo once the security advisory is published?