PowerVM config drive path is not secure

[Andrey Volkov]

This report is based on the Bandit scanner results and code review.

1)
On https://git.openstack.org/cgit/openstack/nova/tree/nova/virt/powervm/media.py?h=refs/heads/master#n44

43 _VOPT_SIZE_GB = 1
44 _VOPT_TMPDIR = '/tmp/cfgdrv/'
45

We have hardcoded tmp dir that could be cleaned up after compute node reboot.
As mentioned in todo it might be good to use conf option.

2)
On https://git.openstack.org/cgit/openstack/nova/tree/nova/virt/powervm/media.py?h=refs/heads/master#n116
Predictable file name based on a user input is used:
116 file_name = pvm_util.sanitize_file_name_for_api(
117 instance.name, prefix='cfg_', suffix='.iso',
118 max_len=pvm_const.MaxLen.VOPT_NAME)
Probably we could use instance.uuid for that.

[Andrey Volkov (avolkov)]

https://security.openstack.org/guidelines/dg_using-temporary-files-securely.html

[Matthew Edmonds (edmondsw)]

I don't think we need to worry about the TMPDIR getting cleaned up, but we shouldn't be using predictable temp dir/file names.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/610174

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/610174
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=4afe8ea5a19e236b485da3132d66064017a479ec
Submitter: Zuul
Branch: master

commit 4afe8ea5a19e236b485da3132d66064017a479ec
Author: Matthew Edmonds <email address hidden>
Date: Fri Oct 12 17:26:29 2018 -0400

    Use tempfile for powervm config drive

    There are potential security issues with using predictable temp
    directories or files, so use python's tempfile module to do this
    safely.

    Change-Id: Ia067236785882ad3acca23a425ea1333b247d8c6
    Closes-Bug: #1771538

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/613342
Committed: https://git.openstack.org/cgit/openstack/nova-powervm/commit/?id=54e501481de97d600f4c8757dc4cdac80ba5ab54
Submitter: Zuul
Branch: master

commit 54e501481de97d600f4c8757dc4cdac80ba5ab54
Author: Matthew Edmonds <email address hidden>
Date: Thu Oct 25 10:45:47 2018 -0400

    Use tempfile for powervm config drive

    There are potential security issues with using predictable temp
    directories or files, so use python's tempfile module to do this
    safely.

    Change-Id: I5e23933af71180da1d55950fcf49e39b0b800ef5
    Closes-Bug: #1771538

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova-powervm 8.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 19.0.0.0rc1 release candidate.