Insecure partition layout: Adjust partition layout on MOS slave nodes

[Adam Heczko]

Observed on:
All slave nodes deployed by Fuel

Problem description:
Currently Fuel partitions target installation disk on SLAVE nodes as follows (controller example, MOS 7.0):
root@contr1:~# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/os-root 50G 2.6G 45G 6% /
none 4.0K 0 4.0K 0% /sys/fs/cgroup
udev 7.9G 12K 7.9G 1% /dev
tmpfs 1.6G 123M 1.5G 8% /run
none 5.0M 0 5.0M 0% /run/lock
none 7.9G 60M 7.8G 1% /run/shm
none 100M 0 100M 0% /run/user
/dev/vda3 196M 39M 148M 21% /boot
/dev/mapper/logs-log 9.8G 5.2G 4.1G 57% /var/log
/dev/mapper/mysql-root 20G 6.3G 13G 34% /var/lib/mysql

Solution proposal:
In order to improve security and meet certain compliance requirements it is required to adjust current partition layout.
Let’s introduce new partitions as follows:
/home , 10G
/tmp , 10G
/horizon , 20G
/var/log/audit , 5G

As a result we'd like to have following partition layout on slave nodes (controller example):
/
/sys/fs/cgroup
/dev
/run
/run/lock
/run/shm
/run/user
/boot
/var/log
/var/lib/mysql
/home
/horizon
/var/log/audit

[Bogdan Dobrelya (bogdando)]

This is not a bug but a feature. Request.

[Sergii Golovatiuk (sgolovatiuk)]

I do not understand why we need separate partition for horizon.

[Adam Heczko (aheczko-mirantis)]

Because of this bug: https://bugs.launchpad.net/fuel/+bug/1518082

[Alex Schultz (alex-schultz)]

Currently (I believe) the horizon partition is /var/lib/horizon, do we need to move it to /horizon or is it ok to leave it as /var/lib/horizon?

[Matthew Mosesohn (raytrac3r)]

+1 to keep /var/lib/horizon

[Michael Polenchuk (mpolenchuk)]

I guess this not a library bug (partition's scheme resides in fuel-web & applies by fuel-agent)

[Roman Prykhodchenko (romcheg)]

Moving a feature bug to the Newton release.

[Sergii Golovatiuk (sgolovatiuk)]

Lowering this bug to medium as it doesn't meet the requirements of high bug.

[Vladimir Kozhukalov (kozhukalov)]

Horizon now is on a separate partition [1], so the motivation for this bug to exist is not actual any more. As for possibility to configure partitioning scheme flexibly, it is definitely not a bug, but a feature request. This bug is rather 'Invalid'.

[1] https://review.openstack.org/#/c/253542

[Adam Heczko (aheczko-mirantis)]

Bug is still valid because STIG compliance assessment fails.
http://people.redhat.com/swells/scap-security-guide/RHEL/7/output/table-rhel7-stig.html

[Adam Heczko (aheczko-mirantis)]

As agreed with PdM we'll need to have fix this for MOS 9.1.
Partition layout requirements are described briefly here [1] and here [2]:

[1] http://people.redhat.com/swells/scap-security-guide/RHEL/7/output/table-rhel7-stig.html
[2] http://www.cyberciti.biz/faq/linux-add-nodev-nosuid-noexec-options-to-temporary-storage-partitions/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/340841

[OpenStack Infra (hudson-openstack)]

Change abandoned by Grzegorz Szafrański (<email address hidden>) on branch: master
Review: https://review.openstack.org/340240
Reason: duplicate of c/340841/1

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/341511

[OpenStack Infra (hudson-openstack)]

Change abandoned by Grzegorz Szafrański (<email address hidden>) on branch: master
Review: https://review.openstack.org/341511
Reason: duplicate

[OpenStack Infra (hudson-openstack)]

Change abandoned by Andreas Jaeger (<email address hidden>) on branch: master
Review: https://review.opendev.org/340841
Reason: This repo is retired now, no further work will get merged.