diff options
| author | Zuul <zuul@review.opendev.org> | 2020-08-19 16:46:53 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2020-08-19 16:46:53 +0000 |
| commit | 393888a1cbddf8453e2be43f243be7187eaa2774 (patch) | |
| tree | f4f4c1d21ea35c2d8d31c66bf9dbb74024b0e588 | |
| parent | db6a9d61ec9fd609f7cdab2d2afd1f2c680f6061 (diff) | |
| parent | 16f97867a3f7050ac42fbb921310ca884e974a11 (diff) | |
| download | kolla-ansible-393888a1cbddf8453e2be43f243be7187eaa2774.tar.gz kolla-ansible-393888a1cbddf8453e2be43f243be7187eaa2774.zip | |
Merge "Fix ownership and permissions of admin-openrc.sh"
| -rw-r--r-- | ansible/post-deploy.yml | 6 | ||||
| -rw-r--r-- | releasenotes/notes/fix-admin-openrc-ownership-mode-310d89a6f50a9640.yaml | 19 |
2 files changed, 23 insertions, 2 deletions
diff --git a/ansible/post-deploy.yml b/ansible/post-deploy.yml index f0bc32c88..6bf8b482c 100644 --- a/ansible/post-deploy.yml +++ b/ansible/post-deploy.yml @@ -1,10 +1,12 @@ --- - name: Creating admin openrc file on the deploy node hosts: localhost - become: true tasks: - name: Template out admin-openrc.sh + become: true template: src: "roles/common/templates/admin-openrc.sh.j2" dest: "{{ node_config }}/admin-openrc.sh" - run_once: True + owner: "{{ ansible_user_uid }}" + group: "{{ ansible_user_gid }}" + mode: 0600 diff --git a/releasenotes/notes/fix-admin-openrc-ownership-mode-310d89a6f50a9640.yaml b/releasenotes/notes/fix-admin-openrc-ownership-mode-310d89a6f50a9640.yaml new file mode 100644 index 000000000..238013027 --- /dev/null +++ b/releasenotes/notes/fix-admin-openrc-ownership-mode-310d89a6f50a9640.yaml @@ -0,0 +1,19 @@ +--- +security: + - | + The ``admin-openrc.sh`` file generated by ``kolla-ansible post-deploy`` was + previously created with ``root:root`` ownership and ``644`` permissions. + This would allow anyone with access to the same directory to read the file, + including the admin credentials. The ownership of ``admin-openrc.sh`` is + now set to the user executing ``kolla-ansible``, and the file is assigned a + mode of ``600``. This change can be applied by running ``kolla-ansible + post-deploy``. +fixes: + - | + The ``admin-openrc.sh`` file generated by ``kolla-ansible post-deploy`` was + previously created with ``root:root`` ownership and ``644`` permissions. + This would allow anyone with access to the same directory to read the file, + including the admin credentials. The ownership of ``admin-openrc.sh`` is + now set to the user executing ``kolla-ansible``, and the file is assigned a + mode of ``600``. This change can be applied by running ``kolla-ansible + post-deploy``. |