root-enable gives access to create unnnoticed root-like users

[Sushil Kumar]

A security hole exists where a user can create an alternate root user, using following workflow

1. create an instance.
2. enable root
3. create another user manually after logging into database, and grant full access.
4. delete 'root'@'%' user.
5. backup the instance.
6. restore the backup to another instance, now this new instance has a root-access user without the knowledge of deployer.

[Amrith Kumar (amrith)]

I suggest you enter a BP for this

[Sushil Kumar (sushil-kumar2)]

With the fix I have proposed(https://review.openstack.org/#/c/199635/), it seems to me a simple one liner.

[Morgan Jones (6-morgan)]

Doing a blueprint is more about the impact of the change and how many people should have the option to review the change, than it has to do with the number of lines of code changed. While I see the merit of this change, even if it is not the complete solution to the problem, I do believe a blueprint is warranted to increase the visibility of the change.

[Craig Vyvial (cp16net)]

I disagree with Morgan here because it is a bug in the code and not an additional feature.

[Amrith Kumar (amrith)]

What is the "bug" here?

You grant a person super-user access, then you can assume that the person will do things that are permissible with that superuser access.

The implication of 'root access' is that once granted, the instance is tainted. Once root access is granted to an instance, it is forever 'root enabled'.

Therefore to claim that this is a security hole is, first of all, not a meaningful assumption.

I requested a bp (in my review) and I believe that there is more to consider here than merely changing one query. That is akin to applying Johnson and Johnson's finest Band Aid on the side of the HMS Titanic.

[OpenStack Infra (hudson-openstack)]

Change abandoned by amrith (<email address hidden>) on branch: master
Review: https://review.openstack.org/199635
Reason: per trove meeting, August 10th, this is being abandoned for inactivity. If you want to continue work on this you can restore it.