neutron is not dropping radvd privileges

[Antonio Ojea]

neutron is not dropping the radvd privileges and causes that radvd run with full privileges, that can be considered as a serious risk.
In addition, some distributions like SUSE, by default runs radvd process as a non privileged user by default, causing radvd failure to daemonize because it can't write the pid in the corresponding neutron folder and break the IPv6 functionality.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/576923
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=9f2b40f2cecc116906e77d69797c0c6877bd5b4d
Submitter: Zuul
Branch: master

commit 9f2b40f2cecc116906e77d69797c0c6877bd5b4d
Author: aojeagarcia <email address hidden>
Date: Wed Jun 20 18:53:36 2018 +0200

    Dropping radvd process privileges

    radvd needs to run as root, but has the capability to drop privileges on
    linux hosts. Currently, radvd process is not using this feature and
    this can be considered a serious risk.

    In addition, some distributions like SUSE, radvd process runs as a non
    privileged user by default, causing radvd failure to daemonize
    because it can't write the pid in the corresponding neutron folder and
    break the IPv6 functionality.

    This patch allows radvd process to run with the same user used by
    neutron. In order to allow this, it changes the radvd config file
    permissions to 444 because radvd doesn't allow that this file can be
    writeable by self/group. The readonly mode is not a problem updating the
    file because of the way the neutron_lib replace_file function handles
    the files operations.

    Closes-Bug: #1777922

    Change-Id: Ic5d976ba71a966a537d1f31888f82997a7ccb0de
    Signed-off-by: aojeagarcia <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/578161

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/578167

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/578167
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=e6c63513de5f715437b03d8718b06f496a1e1646
Submitter: Zuul
Branch: stable/pike

commit e6c63513de5f715437b03d8718b06f496a1e1646
Author: aojeagarcia <email address hidden>
Date: Wed Jun 20 18:53:36 2018 +0200

    Dropping radvd process privileges

    radvd needs to run as root, but has the capability to drop privileges on
    linux hosts. Currently, radvd process is not using this feature and
    this can be considered a serious risk.

    In addition, some distributions like SUSE, radvd process runs as a non
    privileged user by default, causing radvd failure to daemonize
    because it can't write the pid in the corresponding neutron folder and
    break the IPv6 functionality.

    This patch allows radvd process to run with the same user used by
    neutron. In order to allow this, it changes the radvd config file
    permissions to 444 because radvd doesn't allow that this file can be
    writeable by self/group. The readonly mode is not a problem updating the
    file because of the way the neutron_lib replace_file function handles
    the files operations.

    Closes-Bug: #1777922

    Change-Id: Ic5d976ba71a966a537d1f31888f82997a7ccb0de
    Signed-off-by: aojeagarcia <email address hidden>
    (cherry picked from commit 9f2b40f2cecc116906e77d69797c0c6877bd5b4d)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/578161
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=11e604a55058eaf368e64e4c72bf1cba88904517
Submitter: Zuul
Branch: stable/queens

commit 11e604a55058eaf368e64e4c72bf1cba88904517
Author: aojeagarcia <email address hidden>
Date: Wed Jun 20 18:53:36 2018 +0200

    Dropping radvd process privileges

    radvd needs to run as root, but has the capability to drop privileges on
    linux hosts. Currently, radvd process is not using this feature and
    this can be considered a serious risk.

    In addition, some distributions like SUSE, radvd process runs as a non
    privileged user by default, causing radvd failure to daemonize
    because it can't write the pid in the corresponding neutron folder and
    break the IPv6 functionality.

    This patch allows radvd process to run with the same user used by
    neutron. In order to allow this, it changes the radvd config file
    permissions to 444 because radvd doesn't allow that this file can be
    writeable by self/group. The readonly mode is not a problem updating the
    file because of the way the neutron_lib replace_file function handles
    the files operations.

    Closes-Bug: #1777922

    Change-Id: Ic5d976ba71a966a537d1f31888f82997a7ccb0de
    Signed-off-by: aojeagarcia <email address hidden>
    (cherry picked from commit 9f2b40f2cecc116906e77d69797c0c6877bd5b4d)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 13.0.0.0b3 development milestone.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 12.0.4 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 11.0.6 release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/625288

[OpenStack Infra (hudson-openstack)]

Change abandoned by Antonio Ojea (<email address hidden>) on branch: stable/ocata
Review: https://review.openstack.org/625288