This needs to be fixed in filter definitions for each project, not in
the lib itself.
** Changed in: oslo
Status: Triaged => Invalid
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/948520
Title:
nova-rootwrap does a poor job of validating parameters
Status in Cinder:
Triaged
Status in OpenStack Compute (Nova):
Triaged
Status in Oslo - a Library of Common OpenStack Code:
Invalid
Bug description:
Although nova-rootwrap does limit which commands can be run as root,
it doesn't validate the parameters passed through.
For example, '/bin/dd' is allowed by by 'nova/rootwrap/compute.py'
which can be exploited in the following fashion:
'sudo nova-rootwrap dd if=/tmp/mypw of=/etc/passwd'
This means that if someone can get nova user access they can gain root
access.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/948520/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : [email protected]
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
