cinder allows 'env' as commandfilter in rootwrap

[Dirk Mueller]

cinder/image/image_utils.py uses

  def qemu_img_info(path):
      """Return a object containing the parsed output from qemu-img info."""
      out, err = utils.execute('env', 'LC_ALL=C', 'LANG=C',
                               'qemu-img', 'info', path,
                               run_as_root=True)
      return QemuImgInfo(out)

This was added as part of I849b04b8aae76da068abcd2a20c1fcecca8a5caa

There is nothing wrong with that per se, however the rootwrap filters were updated with:

+ env: CommandFilter, /usr/bin/env, root

env is a wrapper that allows to run any command in the $PATH, so this is more or less equivalent to allowing bash in commandfilter. As a hardening precaution, env should not be allowed in CommandFilter.

The code in question can be easily reworked and EnvFilter can be used instead to harden the check.

[John Griffith (john-griffith)]

Seems this should be fixed up in other places as well, including the brick/local_dev/lvm.py code.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/67313
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=9c1ad54e7815d50d9561d88337724ad2042c92a2
Submitter: Jenkins
Branch: master

commit 9c1ad54e7815d50d9561d88337724ad2042c92a2
Author: Dirk Mueller <email address hidden>
Date: Thu Jan 16 22:59:41 2014 +0100

    Remove env from rootwrap filter

    Allowing 'env' as a CommandFilter is similar to
    allowing '/bin/bash', which makes all of rootwrap pointless.
    Use EnvFilter instead. Change corresponding commands
    that use env for setting C locale and adjust rootwrap
    filters accordingly.

    Several commands that output information that is
    parsed as input by cinder change their behavior
    based on the environment locale, which is depending
    on local system settings. The code is however only
    able to parse in C locale, so enforce that one.

    Closes-Bug: #1269958

    Change-Id: Ie1463e608c80204c7a8906efb95899a66aa733da