** Changed in: cinder
Status: Triaged => Won't Fix
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/948520
Title:
nova-rootwrap does a poor job of validating parameters
Status in Cinder:
Won't Fix
Status in OpenStack Compute (nova):
Invalid
Status in oslo-incubator:
Invalid
Bug description:
Although nova-rootwrap does limit which commands can be run as root,
it doesn't validate the parameters passed through.
For example, '/bin/dd' is allowed by by 'nova/rootwrap/compute.py'
which can be exploited in the following fashion:
'sudo nova-rootwrap dd if=/tmp/mypw of=/etc/passwd'
This means that if someone can get nova user access they can gain root
access.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/948520/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : [email protected]
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
