Open Stack

Reviewed:  https://review.openstack.org/28577
Committed: http://github.com/openstack/keystone/commit/24c25b38ed6fc95ed919ab34463cdb10bdcc57fd
Submitter: Jenkins
Branch:    stable/folsom

commit 24c25b38ed6fc95ed919ab34463cdb10bdcc57fd
Author: Dolph Mathews <dolph.mathews at gmail.com>
Date:   Wed May 8 10:49:20 2013 -0500

    Securely create signing_dir (bug 1174608)
    
    Also verifies the security of an existing signing_dir.
    
    Change-Id: I0685b4274a94ad3974a2b2a7ab3f45830d3934bb
    (cherry picked from python-keystoneclient 1736e2ffb12f70eeebed019448bc14def48aa036)

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1174608

Title:
  Insecure directory creation for signing

Status in OpenStack Identity (Keystone):
  Invalid
Status in Keystone folsom series:
  Fix Committed
Status in OpenStack Compute (Nova):
  Fix Committed
Status in OpenStack Compute (nova) folsom series:
  Fix Committed
Status in OpenStack Compute (nova) grizzly series:
  Fix Committed
Status in Python client library for Keystone:
  Fix Committed

Bug description:
  Originally found by Grant Murphy (gmurphy at redhat.com):

  The signing directory is used to store the signing certificates
  and the default location for this directory is:

      signing_dir = /tmp/keystone-signing-nova

  In the file:

     keystone/middleware/auth_token.py

  During the initialization of the AuthMiddleware the following
  operations are made for the signing directory:

      IF the directory exists but cannot be written to a configuration error is raised.
      ELSE IF the directory doesn't exist, create it.
      NEXT chmod permisions(stat.S_IRWXU) to the signing_directory

  AFAICT The signing certificates used in validation will only be
  fetched from the keystone if the cms_verify action raises an exception
  because the certificate file is missing from the signing directory.

  This means that if an attacker populated the /tmp/keystone-signing-nova
  with the appropriate files for signautre verification they could potentially
  issue forged tokens which would be validated by the middleware. As:
      - The directory location deterministic. (default for glance, nova)
      - *If the directory already exists it is reused*

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1174608/+subscriptions