Files in Scality driver are created world readable/writable

[Travis McPeak]

On this line in the Scality driver: https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/scality.py#L124 files which are created by the utility function are set to word readable and writable. This function is utilized in the following cases:

- volume creation: https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/scality.py#L156
- snapshot creation: https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/scality.py#L178
- volume extension: https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/scality.py#L289

While it's possible that these files are supposed to be created in a directory which is protected, files should always be restricted according to the principle of least privilege. If these files are created in a directory without restricted permissions, any user on the system can tamper with these volumes and snapshots.

[Tristan Cacqueray (tristan-cacqueray)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

Can cinder-coresec please confirm if the parent directory protect the overly permissive file permission ?

[Travis McPeak (travis-mcpeak)]

This vulnerability looks like it has existed since the Icehouse release.

[Mike Perez (thingee)]

Confirmed this in /var/lib/scality. I believe this should be fine.

[Thierry Carrez (ttx)]

If the parent directory is safe, this could be considered a strengthening opportunity (and not generate OSSA). If everyone agrees on that analysis, we could open this bug on Monday and make it a public strengthening bug.

[Jay Bryant (jsbryant)]

I am ok with that plan Thierry.

[Tristan Cacqueray (tristan-cacqueray)]

I agree with a D class type of bug ( https://wiki.openstack.org/wiki/Vulnerability_Management#Incident_report_taxonomy )

[Jeremy Stanley (fungi)]

Yes, this looks like security hardening, not an exploitable vulnerability.

[Sean McGinnis (sean-mcginnis)]

Scality driver has been removed.