Open Stack

Fix proposed to branch: master
Review: https://review.openstack.org/28568

** Changed in: nova
       Status: Confirmed => In Progress

** Changed in: nova
     Assignee: (unassigned) => Russell Bryant (russellb)

** Changed in: nova/grizzly
       Status: New => In Progress

** Changed in: nova/grizzly
     Assignee: (unassigned) => Russell Bryant (russellb)

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1174608

Title:
  Insecure directory creation for signing

Status in OpenStack Compute (Nova):
  In Progress
Status in OpenStack Compute (nova) folsom series:
  In Progress
Status in OpenStack Compute (nova) grizzly series:
  In Progress
Status in Python client library for Keystone:
  In Progress

Bug description:
  Originally found by Grant Murphy (gmurphy at redhat.com):

  The signing directory is used to store the signing certificates
  and the default location for this directory is:

      signing_dir = /tmp/keystone-signing-nova

  In the file:

     keystone/middleware/auth_token.py

  During the initialization of the AuthMiddleware the following
  operations are made for the signing directory:

      IF the directory exists but cannot be written to a configuration error is raised.
      ELSE IF the directory doesn't exist, create it.
      NEXT chmod permisions(stat.S_IRWXU) to the signing_directory

  AFAICT The signing certificates used in validation will only be
  fetched from the keystone if the cms_verify action raises an exception
  because the certificate file is missing from the signing directory.

  This means that if an attacker populated the /tmp/keystone-signing-nova
  with the appropriate files for signautre verification they could potentially
  issue forged tokens which would be validated by the middleware. As:
      - The directory location deterministic. (default for glance, nova)
      - *If the directory already exists it is reused*

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1174608/+subscriptions