openstack/kolla.git/docker/ironic-inspector, branch zed-eom

Fix writable rootwrap/privsep config

2022-10-10T15:06:05+00:00

Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298

flatten images a bit

2022-04-21T18:53:14+00:00

As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0

Adjust permissions on _extend_start files.

2022-04-11T15:22:24+00:00

Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0

docker: drop binary parts

2022-04-09T15:44:26+00:00

Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3

Install iptables in ironic-inspector container

2020-12-20T02:31:00+00:00

The centos environment ironic-inspector use iptables filter need install iptables rpm package. Change-Id: I67081a37977dd6de37a67fcd012e002f2e46743f Closes-bug: #1906635

Run Ironic Inspector as ironic-inspector user

2020-09-25T16:37:48+00:00

This patch reverts changes to the Dockerfile and configuration script that were made to support running the service using wsgi. Ironic Inspector does not currently support running with wsgi. Change-Id: Idc816f25c85ef7d5cd14182fe01b652876cb181a

Enable mod_wsgi in Ironic API and Inspector container

2020-08-19T23:11:46+00:00

This patch modifies the Dockerfile for both the Ironic API and Inspector so that the 'root' user executes the container setup scripts. This enables the container httpd configuration script to execute. Change-Id: I02b58ac571cd4eb3b9d4a814fe0cb907a3564e23

Add block labels to all Dockerfiles

2020-03-01T17:25:58+00:00

Change-Id: I9692dda817ef134d647247431565e1b58cf9da41

ironic-inspector: install the dnsmasq subpackage explicitly

2019-09-03T11:03:35+00:00

We are splitting the ironic-inspector package into RDO into ironic-inspector itself and its dnsmasq service. This change updates kolla to install both packages to avoid breakages when RDO removes mutual dependency between them. Change-Id: I2acb070f725aa563781dfe5d325834e1e2675edf

Fix ownership of ironic inspector DHCP hostsdir

2019-06-09T16:36:14+00:00

If you run with enable_ironic set to true and ironic_inspector_pxe_filter set to dnsmasq (the default in stein), ironic inspector can fail with the following in the logs: Permission denied: u'/var/lib/ironic-inspector/dhcp-hostsdir/' A node must be registered with a port for this to happen. Weirdly this happens on centos/source, ubuntu/source, and ubuntu/binary, but not centos/binary. This change changes the ownership of /var/lib/ironic-inspector/dhcp-hostsdir to ironic-inspector user to make it writeable. Change-Id: I19447727f19dbd9c0a3e17d218b48ddc4c253587 Closes-Bug: #1832026