openstack/kolla.git - Unnamed repository; edit this file 'description' to name the repository.

Age	Commit message (Collapse)	Author	Files	Lines
2022-08-29	Fix CVE-2022-38060	Radosław Piliszek	1	-0/+2
	Closes-Bug: #1985784 Change-Id: I66476a2b396e2cbe41e68ac51f57aae1806b2ed8
2019-10-12	Custom CA certificates installation mechanism	Viktor Michalek	1	-0/+3
	Change-Id: I0fd596d93a0e575a391250d4bed261ad370a3664
2016-12-18	Remove /usr/bin/install from allowed commands	Sam Yaple	1	-1/+1
	This essentially allows the user to copy any files and set any ownership on any files. Can be used to do anything on the system and all users in 'kolla' group have access to it. Change-Id: I9d6cd2b4ca40cb536484fa45e80692105b5fa2a4
2016-02-23	Remove Rsyslog entirely	Éric Lemoine	1	-1/+1
	Partially implements: blueprint heka Change-Id: I1322d2dc870e6f8fe052926995d993e8a08a25db
2016-02-16	Move socket binding to named_volume	SamYaple	1	-1/+1
	The extend_start.sh script for rsyslog is removed as it is no longer needed. Docker no longer binds to /dev/log or /run/kolla/log Closes-Bug: #1544545 Change-Id: Ic0a323a26ee4e9e15baf4598285844a8a4955f23
2015-12-02	Add support for copying files from a "zk://" source	Angus Salkeld	1	-1/+1
	Co-Authored-By: Michal Rostecki <mrostecki@mirantis.com> Implements: blueprint zookeeper Change-Id: I176f063d3802716846b921e210c1569d28bd90d8
2015-11-12	Drop root privileges for mariadb	Steven Dake	1	-0/+2
	Drop root privileges for mariadb. This isn't perfect. If somemone breaks out of the container and can run sudo within the contianer, it would be possible to replace the root credentials of the database. Any container that uses sudo suffers from some extra attack vector related to the sudo command. That said, the sudo commands are locked down to minimize harm. Change-Id: I4b3573725d940bb8aa90d43a6235d8cf7d30fc64 Partially-Implements: blueprint drop-root
2015-11-09	Base image changes for drop-root	Steven Dake	1	-0/+16
	The reason we are doing drop root is so that a network exposed software component (i.e. glance) cannot be used to affect the immutability of the container which it runs in. I have tried several different approaches and this is the only approach which puts glance in PID=1 while ensuring no files may be written by the glance process in the container image except for the log files. Change-Id: Ifd3c8c361b78d0e4791dade3afa6435290407c41 Partially-Implements: blueprint drop-root