Unnamed repository; edit this file 'description' to name the repository. https://git.platform-os.org/openstack/kolla.git/atom?h=zed-eom 2022-08-29T10:05:05+00:00 2022-08-29T10:05:05+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2022-08-29T09:55:59+00:00 urn:sha1:5b1da017988c987fc68b55d1f45b5d2676474ce1 Closes-Bug: #1985784 Change-Id: I66476a2b396e2cbe41e68ac51f57aae1806b2ed8 2019-10-12T15:36:27+00:00 Viktor Michalek viktor.michalek@ultimum.io 2019-08-31T00:44:46+00:00 urn:sha1:79d857f9e70b4aa2fe71055cbed93557c3d21362 Change-Id: I0fd596d93a0e575a391250d4bed261ad370a3664 2016-12-18T20:48:27+00:00 Sam Yaple sam@yaple.net 2016-12-18T20:48:27+00:00 urn:sha1:73681e760723e899252bd814745ea891c757b7c6 This essentially allows the user to copy any files and set any ownership on any files. Can be used to do anything on the system and all users in 'kolla' group have access to it. Change-Id: I9d6cd2b4ca40cb536484fa45e80692105b5fa2a4 2016-02-23T09:45:23+00:00 Éric Lemoine elemoine@mirantis.com 2016-02-22T16:13:58+00:00 urn:sha1:0417844b8d1babf3bb95d5237c7811c06d9b6347 Partially implements: blueprint heka Change-Id: I1322d2dc870e6f8fe052926995d993e8a08a25db 2016-02-16T14:42:41+00:00 SamYaple sam@yaple.net 2016-02-15T20:49:04+00:00 urn:sha1:690e6853de1215775c672c9cb6be5190887b37da The extend_start.sh script for rsyslog is removed as it is no longer needed. Docker no longer binds to /dev/log or /run/kolla/log Closes-Bug: #1544545 Change-Id: Ic0a323a26ee4e9e15baf4598285844a8a4955f23 2015-12-02T09:25:43+00:00 Angus Salkeld asalkeld@mirantis.com 2015-11-19T05:35:22+00:00 urn:sha1:27c0ae06241e18f6639311aba65657b4ef83cf26 Co-Authored-By: Michal Rostecki <mrostecki@mirantis.com> Implements: blueprint zookeeper Change-Id: I176f063d3802716846b921e210c1569d28bd90d8 2015-11-12T08:12:40+00:00 Steven Dake stdake@cisco.com 2015-11-10T09:11:20+00:00 urn:sha1:4c9e15b94e3f8e27a3ef194768c64357efa9ea82 Drop root privileges for mariadb. This isn't perfect. If somemone breaks out of the container and can run sudo within the contianer, it would be possible to replace the root credentials of the database. Any container that uses sudo suffers from some extra attack vector related to the sudo command. That said, the sudo commands are locked down to minimize harm. Change-Id: I4b3573725d940bb8aa90d43a6235d8cf7d30fc64 Partially-Implements: blueprint drop-root 2015-11-09T16:00:26+00:00 Steven Dake stdake@cisco.com 2015-11-08T21:34:32+00:00 urn:sha1:6cf5928ff1ee2f9d21662d74057f3a8331ddedfb The reason we are doing drop root is so that a network exposed software component (i.e. glance) cannot be used to affect the immutability of the container which it runs in. I have tried several different approaches and this is the only approach which puts glance in PID=1 while ensuring no files may be written by the glance process in the container image except for the log files. Change-Id: Ifd3c8c361b78d0e4791dade3afa6435290407c41 Partially-Implements: blueprint drop-root