Drop root privileges to the container's application PID/GID
Use the USER flag to set the UID for each container to the specific service that should be running.
Blueprint information
- Status:
- Complete
- Approver:
- Steven Dake
- Priority:
- Essential
- Drafter:
- Steven Dake
- Direction:
- Approved
- Assignee:
- Steven Dake
- Definition:
- Approved
- Series goal:
- Accepted for mitaka
- Implementation:
-
Implemented
- Milestone target:
-
mitaka-3
- Started by
- Steven Dake
- Completed by
- Steven Dake
Related branches
Related bugs
Sprints
Whiteboard
base is a dependency of all other containers. Please wait for base and glance to hit the repo before beginning work. Thanks! --sdake
The implementation should be thought about more here. With yaodu there was no chance of a compromised user to execute arbitrary code on a container restart. That is not the case with the implementation that has started in Kolla. The current patches up for this would allow for a compromised user to change the command executed on container restart. --SamYaple
I'm open to suggestions to solve this problem. ATM the container when run with USER runs the set_configs.py code as the user, not root. This file is responsible for writing the run_command. The only way I see to achieve what you want is to drop privileges inside run_command. --sdake
Looks like we found a proper solution to this problem. The services are ready to be securified now. I expect nova/neutron/
The horizon patch was a bit of a special snowflake and has an interesting example of how to obtain a root capability on a binary - if you don't mind the binary permanently having the capability. --sdake
I think we should postpone logging drop-root until the heka + elk solutions are sorted out. --steak
I unassigned work items that didn't complete prior to mitaka-2. Please feel free to reassign yourself if you plan to do that work in the next few weeks. --steak
Gerrit topic: https:/
Addressed by: https:/
Prepare base images for USER operation
Addressed by: https:/
Drop root privileges for glance services
Addressed by: https:/
Drop root privileges for heat services
Addressed by: https:/
Take two of root drop
Addressed by: https:/
Base image changes for drop-root
Addressed by: https:/
drop root for glance
Addressed by: https:/
Drop root for heat
Addressed by: https:/
Drop root for Horizon service
Addressed by: https:/
Move the mariadb expect code to a script
Addressed by: https:/
Drop root privileges for mariadb
Addressed by: https:/
Drop root for designate
Addressed by: https:/
install openstack-
Addressed by: https:/
Drop root for kolla-ansible
Addressed by: https:/
Move USER operation after footer
Containers not needing update:
Keystone - apache does its own drop root, and sudo as PID 1 is not desirable
Keepalive - keepalived needs root privs and sudo as PID 1 is not desirable
Horizon - apache does its own drop root, and sudo as PID 1 is not desireable
Addressed by: https:/
Drop root for rsyslog
Addressed by: https:/
[WIP} Drop root privileges for openvswitch
Addressed by: https:/
Add new gates for oraclelinux
Gerrit topic: https:/
Addressed by: https:/
Drop root for Magnum
Addressed by: https:/
Drop root for ceilometer
Addressed by: https:/
Drop root for gnocchi
Addressed by: https:/
Drop root for neutron
Addressed by: https:/
Update ceilometer dockerfiles
Addressed by: https:/
Drop root for ironic
Addressed by: https:/
Added ironic-common to ironic base container
Addressed by: https:/
Update ceilometer dockerfiles
Addressed by: https:/
install openstack-
Addressed by: https:/
Added ironic-common to ironic base container
Addressed by: https:/
Drop root for murano
Addressed by: https:/
Drop root for cinder
Addressed by: https:/
Drop root for nova
Addressed by: https:/
Add support for Aodh
Addressed by: https:/
Drop root for libvirt
Addressed by: https:/
Drop root for swift
Addressed by: https:/
drop root for libvirt and change sock grp to nova
Addressed by: https:/
Fix broken nova-compute/
Addressed by: https:/
[WIP] Allow nova user to access libvirt
Addressed by: https:/
Make nova configuration files immutable
Gerrit topic: https:/
Addressed by: https:/
Correct issue with virtualenv rootwrap
Gerrit topic: https:/
Work Items
Work items:
(sdake): base: DONE
(coolsvap) ceilometer: DONE
(unassigned) ceph: TODO
(coolsvap) cinder: DONE
(nihilifer) designate: DONE
(unassigned) dind: POSTPONED
(akwasnie)
(sdake) glance: DONE
(coolsvap) gnocchi: DONE
(unassigned) haproxy: TODO
(sdake) heat: DONE
(unassigned) heka: TODO
(sdake) horizon: DONE
(coolsvap) ironic: DONE
(akwasnie) kibana: DONE
(britthouser) keepalived: DONE
(britthouser) keystone: DONE
(pbourke) kolla-ansible: DONE
(pbourke) magnum: DONE
(unassigned) manila: DONE
(sdake) mariadb: DONE
(britthouser) memcached: DONE
(unassigned) mongodb: POSTPONED
(coolsvap) murano: DONE
(unassigned) neutron: DONE
(coolsvap) nova: DONE
(rhallise) rabbitmq: DONE
(coolsvap) swift: DONE
(jlothian) zaqar: DONE
