<div dir="ltr">Is there any difference in the rate at which security patches get applied between os's. In particular, i'm trying to compare centos 6.5 vs ubuntu 14.04. <div><br></div><div>What is the process through which security-only patches get passed on to production deployments of openstack.</div>
<div><br></div><div>Is there a difference in the amount of coverage testing for security services between os's?<br><div class="gmail_extra"><br></div><div class="gmail_extra">kesten</div><div class="gmail_extra"><br><br>
<div class="gmail_quote">On Sun, Jun 1, 2014 at 7:00 AM, <span dir="ltr"><<a href="mailto:openstack-security-request@lists.openstack.org" target="_blank">openstack-security-request@lists.openstack.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Openstack-security mailing list submissions to<br>
<a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a><br>
<br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:openstack-security-request@lists.openstack.org">openstack-security-request@lists.openstack.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:openstack-security-owner@lists.openstack.org">openstack-security-owner@lists.openstack.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Openstack-security digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. [Bug 1260679] Re: Multiple drivers set insecure file<br>
permissions (Nathan Kinder)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Sat, 31 May 2014 15:39:21 -0000<br>
From: Nathan Kinder <<a href="mailto:nkinder@redhat.com">nkinder@redhat.com</a>><br>
To: <a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a><br>
Subject: [Openstack-security] [Bug 1260679] Re: Multiple drivers set<br>
insecure file permissions<br>
Message-ID:<br>
<<a href="mailto:20140531153922.20634.22748.malone@chaenomeles.canonical.com">20140531153922.20634.22748.malone@chaenomeles.canonical.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Published as OSSN-0014 on the wiki and the openstack and openstack-dev<br>
mailing lists:<br>
<br>
<a href="https://wiki.openstack.org/wiki/OSSN/OSSN-0014" target="_blank">https://wiki.openstack.org/wiki/OSSN/OSSN-0014</a><br>
<br>
** Changed in: ossn<br>
Status: In Progress => Fix Released<br>
<br>
--<br>
You received this bug notification because you are a member of OpenStack<br>
Security Group, which is subscribed to OpenStack.<br>
<a href="https://bugs.launchpad.net/bugs/1260679" target="_blank">https://bugs.launchpad.net/bugs/1260679</a><br>
<br>
Title:<br>
Multiple drivers set insecure file permissions<br>
<br>
Status in Cinder:<br>
In Progress<br>
Status in OpenStack Security Notes:<br>
Fix Released<br>
<br>
Bug description:<br>
GPFS from various places calls "chmod 666" as root:<br>
<br>
./cinder/volume/drivers/gpfs.py: self._execute('chmod', '666', path, run_as_root=True)<br>
./cinder/volume/drivers/gpfs.py: self._execute('chmod', '666', vol_path, run_as_root=True)<br>
<br>
the Huawei driver sets 777 permissions as root on some files:<br>
<br>
./cinder/volume/drivers/huawei/ssh_common.py: utils.execute('chmod', '777', filepath, run_as_root=True)<br>
./cinder/volume/drivers/huawei/rest_common.py: utils.execute('chmod', '777', filepath, run_as_root=True)<br>
<br>
the Scality driver sets 666 permissions on all volumes:<br>
<br>
cinder/volume/drivers/scality.py:<br>
<br>
????def _create_file(self, path, size):<br>
????????with open(path, "ab") as f:<br>
????????????f.truncate(size)<br>
????????os.chmod(path, 0o666)<br>
<br>
Similarly, the NFS and NEXENTA driver have an implementation of<br>
<br>
def _set_rw_permissions_for_all()<br>
<br>
that is being called on all newly created volumes.<br>
<br>
To manage notifications about this bug go to:<br>
<a href="https://bugs.launchpad.net/cinder/+bug/1260679/+subscriptions" target="_blank">https://bugs.launchpad.net/cinder/+bug/1260679/+subscriptions</a><br>
<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
Openstack-security mailing list<br>
<a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a><br>
<br>
<br>
End of Openstack-security Digest, Vol 16, Issue 1<br>
*************************************************<br>
</blockquote></div><br></div></div></div>