harden kolla horizon usage of /tmp/

[Sven Kieske]

currently kolla-ansible bindmounts /tmp/ from the docker host (so usually the control-plane node) inside the container.

The Webapp itself runs as user horizon, but the Webserver (apache2) runs as root and is able to manipulate arbitrary files in private tmp dirs of services running inside other namespaces/containers on the host, including admin system services like systemd-logind:

dragon@ctl001:~$ docker exec -it --user=root horizon bash
(horizon)[root@ctl001 /]# cd /tmp/systemd-private-9dd6fe4987b6480e821f3e5a0333b4b7-systemd-logind.service-srLJIk/tmp/
(horizon)[root@ctl001 tmp]# touch pwned
(horizon)[root@ctl001 tmp]# ls -lashin
total 8.0K
2097732 4.0K drwxrwxrwt 2 0 0 4.0K Jun 5 07:55 .
2097731 4.0K drwx------ 3 0 0 4.0K Jun 5 07:50 ..
2097519 0 -rw-r--r-- 1 0 0 0 Jun 5 07:55 pwned
dragon@ctl001:~$ sudo su -
root@ctl001:~# ls -lashin /tmp/systemd-private-9dd6fe4987b6480e821f3e5a0333b4b7-systemd-logind.service-srLJIk/tmp
total 8.0K
2097732 4.0K drwxrwxrwt 2 0 0 4.0K Jun 5 07:55 .
2097731 4.0K drwx------ 3 0 0 4.0K Jun 5 07:50 ..
2097519 0 -rw-r--r-- 1 0 0 0 Jun 5 07:55 pwned

I'll provide a patch for that.

See also my downstream bug report at:

https://github.com/osism/issues/issues/1047

I found this bug when researching kolla-ansible for unsafe usage of /tmp/ directories.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/921371

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/921371
Committed: https://opendev.org/openstack/kolla-ansible/commit/f306e9ca88796f3f77fb2f3fef343c167d11b13a
Submitter: "Zuul (22348)"
Branch: master

commit f306e9ca88796f3f77fb2f3fef343c167d11b13a
Author: Sven Kieske <email address hidden>
Date: Wed Jun 5 11:49:59 2024 +0200

    hardening horizon: don't mount hosts /tmp

    consider this a security hardening
    as it would be possible to write to host
    owned private tmp files e.g. of systemd-logind
    when you are able to highjack the apache2 process
    inside the horizon container, which runs as root.

    see the bug report for a demonstration of this.

    I checked the horizon code, it only facilitates
    python tempfiles module for temp file usage.

    I also checked the horizon container we build
    via `kolla-build -b ubuntu horizon`, which has
    a /tmp/ directory.
    So no mountpoint should be needed.

    Closes-Bug: #2068126

    Signed-off-by: Sven Kieske <email address hidden>
    Change-Id: I7ae1db8d42c83b773047bb01e846d4abee02710a

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2024.1
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/927468

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/927469

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/927470

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: unmaintained/zed
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/927661

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: unmaintained/yoga
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/927662