- Release-announce - lists.openstack.org

openstack-ansible-security 12.0.0 (liberty)
by no-reply＠openstack.org 26 May '17

26 May '17

We are thrilled to announce the release of: openstack-ansible-security 12.0.0: Security hardening role for openstack-ansible This release is part of the liberty release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.13
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 12.0.13: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.1.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 12.1.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 13.0.1
by no-reply＠openstack.org 26 May '17

26 May '17

We are glad to announce the release of: openstack-ansible-security 13.0.1: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.2.6
by no-reply＠openstack.org 26 May '17

26 May '17

We are overjoyed to announce the release of: openstack-ansible-security 12.2.6: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.5..12.2.6 ---------------------------------------------------- 44c1bc9 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 12.2.5
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 12.2.5: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.2.5 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 12.2.3..12.2.5 ---------------------------------------------------- 77eaaf2 Disable DAC change auditing 31a8ff5 Disable martian logging by default e7373c4 Exclude /run from AIDE checks 6c9eb50 Ensure AIDE initializes on subsequent runs 23fe90b Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 13.0.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.0.0: Security hardening role for openstack-ansible This is the first release of openstack-ansible-security. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.16
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 12.0.16: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.0.16 ^^^^^^^ New Features ************ * The audit rules added by the security role now have key fields that make it easier to link the audit log entry to the audit rule that caused it to appear. Bug Fixes ********* * The role previously did not restart the audit daemon after generating a new rules file. The bug (https://launchpad.net/bugs/1590916) has been fixed and the audit daemon will be restarted after any audit rule changes. * When the security role was run in Ansible's check mode and a tag was provided, the "check_mode" variable was not being set. Any tasks which depend on that variable would fail. This bug is fixed (https://bugs.launchpad.net/openstack-ansible/+bug/1590086) and the "check_mode" variable is now set properly on every playbook run.

1 0

[cinder] python-cinderclient 2.1.0 (pike)
by no-reply＠openstack.org 25 May '17

25 May '17

We are overjoyed to announce the release of: python-cinderclient 2.1.0: OpenStack Block Storage API Client Library This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/python-cinderclient Download the package from: https://pypi.python.org/pypi/python-cinderclient Please report issues through launchpad: https://bugs.launchpad.net/python-cinderclient For more details, please see below. 2.1.0 ^^^^^ New Features ************ * Use 'cinder reset-state' as generic resource reset state command for resource 'volume', 'snapshot', 'backup' 'group' and 'group- snapshot'. Also change volume's default status from 'available' to none when no status is specified. * Cinderclient now supports noauth mode using *--os-auth-type noauth* param. Also python-cinderclient now supports keystoneauth1 plugins. Deprecation Notes ***************** * --bypass-url param is now deprecated. Please use --os-endpoint instead of it. --os-auth-system param is now deprecated. Please --os-auth-type instead of it. Bug Fixes ********* * The mountpoint argument was ignored when creating an attachment and now has been fixed. [Bug 1675973 (https://bugs.launchpad.net/bugs/1675973) * The 'tenant' argument was ignored when listing attachments, and now has been fixed. [Bug 1675974 (https://bugs.launchpad.net/bugs/1675974) * The 'server_id' is now a required parameter when creating an attachment, that means we should create an attachment with a command like, 'cinder attachment-create <volume> <server_id>'. [Bug 1675975 (https://bugs.launchpad.net/bugs/1675975) Changes in python-cinderclient 2.0.1..2.1.0 ------------------------------------------- 5075eb2 support global_request_id in constructor 8471c6c Eliminate function redefined pylint error 2bfd512 Updated from global requirements 69f0090 Handle dashes in encryption-type-create arguments da4e810 Add doc for noauth usage 3a62acc Updated from global requirements af921bb Cinder client reset-state improvements 990527e Fix the wrong help message of marker 16af9f7 Pretty print 'extra_specs' and 'group_specs' 85b56e1 Fix client `retries` default value. 371831a Tests: Add info to assert_called failure message 650dc13 Replace http with https c384975 Remove direct dependency on requests 51f6668 Updated from global requirements ae7ab7d [BugFix] Make 'instance_id' required in attachment-create CLI. 4ed7118 [BugFix] Add 'all_tenants', 'project_id' in attachment-list 273c724 [BugFix] 'Mountpoint' is missing in attachment CLIs. 60f92db Fix noauth support 7b213a9 Remove log translations bb912de Remove duplicate do_upload_to_image() method def 31a7ba7 Update README.rst to remain consistent with python-cinderclient. c022b73 Fix pep8 errors 25ba0fb Add cinder tests for cinder snapshot create commands with parameters 7b5a91a Update tox to delete py34 Diffstat (except docs and test files) ------------------------------------- README.rst | 315 +++++++++++++---- cinderclient/__init__.py | 5 +- cinderclient/_i18n.py | 10 - cinderclient/auth_plugin.py | 141 -------- cinderclient/client.py | 40 ++- cinderclient/contrib/__init__.py | 0 cinderclient/contrib/noauth.py | 77 ++++ cinderclient/shell.py | 116 +++--- cinderclient/utils.py | 12 +- cinderclient/v1/client.py | 2 +- cinderclient/v2/client.py | 2 +- cinderclient/v2/shell.py | 66 +--- cinderclient/v2/volume_backups.py | 3 +- cinderclient/v3/client.py | 2 +- cinderclient/v3/group_snapshots.py | 15 + cinderclient/v3/groups.py | 15 + cinderclient/v3/shell.py | 125 +++++-- cinderclient/v3/volume_snapshots.py | 3 +- ...neric-reset-state-command-d83v1f3accbf5807.yaml | 7 + .../notes/bug-1675973-ad91a7a9f50e658a.yaml | 5 + .../notes/bug-1675974-34edd5g9870e65b2.yaml | 5 + .../notes/bug-1675975-ad91a7a34e0esywc.yaml | 6 + releasenotes/notes/noauth-7d95e5af31a00e96.yaml | 11 + requirements.txt | 9 +- setup.cfg | 6 +- test-requirements.txt | 4 +- tox.ini | 2 +- 40 files changed, 1054 insertions(+), 813 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 35e2989..d453c69 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 @@ -6,2 +6 @@ PrettyTable<0.8,>=0.7.1 # BSD -keystoneauth1>=2.18.0 # Apache-2.0 -requests!=2.12.2,!=2.13.0,>=2.10.0 # Apache-2.0 +keystoneauth1>=2.20.0 # Apache-2.0 @@ -9 +8 @@ simplejson>=2.2.0 # MIT -Babel>=2.3.4 # BSD +Babel!=2.4.0,>=2.3.4 # BSD @@ -11 +10 @@ six>=1.9.0 # MIT -oslo.i18n>=2.1.0 # Apache-2.0 +oslo.i18n!=3.15.2,>=2.1.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 8f2783a..c2d1d5b 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -14 +14 @@ requests-mock>=1.1 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

ldappool 2.1.0
by no-reply＠openstack.org 25 May '17

25 May '17

We are amped to announce the release of: ldappool 2.1.0: A simple connector pool for python-ldap. Download the package from: https://pypi.python.org/pypi/ldappool For more details, please see below.

1 0