<div dir="ltr">Hi,<div><br></div><div>Tim and Erik, thanks for the links!</div><div><br></div><div>I saw the RPMs in CentOS7.1 are patched for venom and that they support rbd (but I haven't tested on my conf yet).</div><div><br></div><div>My nova-compute nodes are on CentOS7.0 and IceHouse, do you think they will break if I upgrade them to CentOS7.1?</div><div><br></div><div>Or do you think it will be simpler to just recompile the RHEV SRPMs and replace with the ones I've got?</div><div><br></div><div>Thanks again,</div><div><br></div><div>Best regards,</div><div>Cynthia</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-06-02 16:23 GMT+02:00 Erik McCormick <span dir="ltr"><<a href="mailto:emccormick@cirrusseven.com" target="_blank">emccormick@cirrusseven.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><span class="">On Tue, Jun 2, 2015 at 5:34 AM, Tim Bell <span dir="ltr"><<a href="mailto:Tim.Bell@cern.ch" target="_blank">Tim.Bell@cern.ch</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I had understood that CentOS 7.1 qemu-kvm has RBD support built-in. It was not there on 7.0 but
<a href="http://tracker.ceph.com/issues/10480" target="_blank">http://tracker.ceph.com/issues/10480</a> implies it is in 7.1.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">You could check on the centos mailing lists to be sure.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Tim<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u></span></p></div></div></blockquote><div><br></div></span><div>It's about time! Thanks for the pointer Tim. </div><div><br></div><div>Cynthia, If for some reason it's not in the Centos ones yet, I've been using the RHEV SRPMs and building the packages. You don't have to mess with the spec or anything. Just run them through rpmbuild and push them out.</div><div><br></div><div><a href="http://ftp.redhat.com/pub/redhat/linux/enterprise/7Server/en/RHEV/SRPMS/" target="_blank">http://ftp.redhat.com/pub/redhat/linux/enterprise/7Server/en/RHEV/SRPMS/</a></div><span class="HOEnZb"><font color="#888888"><div><br></div><div>-Erik </div></font></span><div><div class="h5"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-GB" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <u></u></span></p>
<div style="border-style:none none none solid;border-left-color:blue;border-left-width:1.5pt;padding:0cm 0cm 0cm 4pt">
<div>
<div style="border-style:solid none none;border-top-color:rgb(225,225,225);border-top-width:1pt;padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"> Cynthia Lopes [mailto:<a href="mailto:clsacramento@gmail.com" target="_blank">clsacramento@gmail.com</a>]
<br>
<b>Sent:</b> 02 June 2015 10:57<br>
<b>To:</b> Sławek Kapłoński<br>
<b>Cc:</b> <a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.openstack.org</a><span><br>
<b>Subject:</b> Re: [Openstack-operators] Venom vulnerability<u></u><u></u></span></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi guys,<u></u><u></u></p><div><div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I had to recompile qemu-kvm on CentOS7 to enable RBD and be able to use CEPH. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Now, what is the best to update for venom vulnerability? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Has anyone already recompiled the patched sources and put it in a repository, or the only way is to get the knew sources and recompile again ?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">In <a href="http://vault.centos.org/" target="_blank">http://vault.centos.org/</a> les sources don't seen to have been updated yet, where will I find them to recompile if it is the way to go?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks a lot!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Cynthia<u></u><u></u></p>
</div>
</div></div></div><div><div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2015-05-14 23:45 GMT+02:00 Sławek Kapłoński <<a href="mailto:slawek@kaplonski.pl" target="_blank">slawek@kaplonski.pl</a>>:<u></u><u></u></p>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal" style="margin-bottom:12pt">Hello,<br>
<br>
Ok, thx for explanations :) Yep, I know that best is to restart qemu<br>
process but this makes that I can now sleep littlebit more peacefully :)<br>
<br>
<span>--</span><br>
<span>Best regards / Pozdrawiam</span><br>
<span>Sławek Kapłoński</span><br>
<span><a href="mailto:slawek@kaplonski.pl" target="_blank">slawek@kaplonski.pl</a></span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, May 14, 2015 at 05:38:56PM -0400, Favyen Bastani wrote:<br>
> On 05/14/2015 05:23 PM, Sławek Kapłoński wrote:<br>
> > Hello,<br>
> ><br>
> > So if I understand You correct, it is not so dangeorus if I'm using<br>
> > ibvirt with apparmor and this libvirt is adding apparmor rules for<br>
> > every qemu process, yes?<br>
> ><br>
> ><br>
><br>
> You should certainly verify that apparmor rules are enabled for the qemu<br>
> processes.<br>
><br>
> Apparmor reduces the danger of the vulnerability. However, if you are<br>
> assuming that virtual machines are untrusted, then you should also<br>
> assume that an attacker can execute whatever operations permitted by the<br>
> apparmor rules (mostly built based on abstraction usually at<br>
> /etc/apparmor.d/libvirt-qemu); so you should check that you have<br>
> reasonable limits on those permissions. Best is to restart the processes<br>
> by way of live migration or otherwise.<br>
><br>
> Best,<br>
> Favyen<br>
<br>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
</div>
<br>_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br></blockquote></div></div></div><br></div></div>
</blockquote></div><br></div>