| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-10-04 | |||
| 14:16:18 | auniyal__ | I was not sure, how to proceed further, so added fake_get_absolute_limit in fixtures.cinder | |
| 14:16:28 | auniyal__ | and then it failed at https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L3239 | |
| 14:16:28 | auniyal__ | here - https://github.com/openstack/nova/blob/master/nova/tests/fixtures/cinder.py | |
| 14:16:28 | auniyal__ | this - https://paste.opendev.org/show/bEV0xVXGyuWohgRHE9Vm/ | |
| 14:16:40 | auniyal__ | as the properties are not set with VOLUME which is used via fixture - | |
| 14:16:41 | auniyal__ | now this went further, but then again it failed at - https://github.com/openstack/nova/blob/master/nova/compute/api.py#L3511 | |
| 14:16:41 | auniyal__ | this - https://paste.opendev.org/show/bJgH2kLDa65iRCz9HuIt/ | |
| 14:16:41 | auniyal__ | So I added one more constant IMAGE_BACKED_VOL_QUIESCE | |
| 14:16:41 | auniyal__ | https://github.com/openstack/nova/blob/aad31e6ba489f720f5bdc765c132fd0f059a0329/nova/tests/fixtures/cinder.py#L154 | |
| 14:16:45 | auniyal__ | with same error which I was getting earlier | |
| 14:16:57 | auniyal__ | ===> keystoneauth1.exceptions.catalog.EmptyCatalog: The service catalog is empty. | |
| 14:36:18 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: api: extend evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858384 | |
| 14:36:18 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: compute: enhance compute evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858383 | |
| 14:55:37 | artom | sahid, ohhai, long time no see | |
| 15:06:58 | bauzas | reminder: nova meeting in 54 mins | |
| 15:51:23 | bauzas | last reminder : nova meeting in 9 mins (and I have to update the agenda, oh man) | |
| 16:00:15 | opendevmeet | The meeting name has been set to 'nova' | |
| 16:00:15 | bauzas | #startmeeting nova | |
| 16:00:15 | opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | |
| 16:00:15 | opendevmeet | Meeting started Tue Oct 4 16:00:15 2022 UTC and is due to finish in 60 minutes. The chair is bauzas. Information about MeetBot at http://wiki.debian.org/MeetBot. | |
| 16:00:21 | bauzas | hey stackers | |
| 16:00:29 | gibi | o/ | |
| 16:00:33 | bauzas | #link https://wiki.openstack.org/wiki/Meetings/Nova#Agenda_for_next_meeting | |
| 16:01:04 | elodilles | o/ | |
| 16:02:05 | bauzas | okay, let's start, hopefully people will join later | |
| 16:02:28 | bauzas | #topic Bugs (stuck/critical) | |
| 16:02:34 | bauzas | #info No Critical bug | |
| 16:02:39 | bauzas | #link https://bugs.launchpad.net/nova/+bugs?search=Search&field.status=New 4 new untriaged bugs (-1 since the last meeting) | |
| 16:02:43 | Uggla | o/ | |
| 16:02:51 | auniyal__ | O/ | |
| 16:02:59 | bauzas | the etherpad I created for this week's triage https://etherpad.opendev.org/p/nova-bug-triage-20220927 | |
| 16:03:38 | bauzas | and I have one security bug I'd like to discuss with the team, now we made it public | |
| 16:03:52 | bauzas | #link https://bugs.launchpad.net/nova/+bug/1989008 Security bug | |
| 16:04:16 | bauzas | I was consider it to close it as Wontfix | |
| 16:04:20 | bauzas | considering* | |
| 16:04:32 | JayF | o/ | |
| 16:05:19 | bauzas | tl;dr: depending on your sudoers rules, you can trick nova user | |
| 16:05:37 | bauzas | we could change our privsep rules to be more restrictive | |
| 16:05:45 | sean-k-mooney[m] | i filed a downstream backlog item to adress it properly | |
| 16:05:47 | bauzas | but we prefer deferring to the host config | |
| 16:05:58 | bauzas | about the permissions rights | |
| 16:06:01 | sean-k-mooney[m] | so longterm i think we shoudl rewirte how we use privesep | |
| 16:06:14 | bauzas | I don't disagree | |
| 16:06:19 | sean-k-mooney[m] | but i dont think we will have time in A | |
| 16:06:24 | bauzas | but this is a long-term effort | |
| 16:06:32 | bauzas | yeah and very tedious effort | |
| 16:06:53 | sean-k-mooney[m] | i personally would not mind tipping away at this over time | |
| 16:07:04 | bauzas | for that reason, I think this is valid to close this bug as Wontfix | |
| 16:07:05 | sean-k-mooney[m] | but not sure i can do it in A | |
| 16:07:17 | bauzas | as this is actually more a request for enhancement than a really butg | |
| 16:07:20 | bauzas | bug* | |
| 16:07:38 | sean-k-mooney[m] | i have no objection to that as its really a speless blueprint or spec in my view | |
| 16:07:57 | bauzas | of course, deployers and openstack distros need to properly care about this bug | |
| 16:08:08 | bauzas | and make sure the rights they give are correctly set | |
| 16:08:19 | sean-k-mooney[m] | its not quite an architectual change but it is a desgin pattern change | |
| 16:08:31 | bauzas | but from an upstream perspective, given no further effort can be simply made, we need to close it | |
| 16:08:42 | bauzas | sean-k-mooney: yeah a refactoring change | |
| 16:08:45 | bauzas | but, | |
| 16:08:51 | sean-k-mooney[m] | so currently it cannot lead to privladge escalation if you dont already have the ablity to spwan the privsep helper | |
| 16:08:57 | sean-k-mooney[m] | or have access to the unix socket of an exsiting one | |
| 16:08:58 | bauzas | sean-k-mooney: we correctly need to make it | |
| 16:09:09 | bauzas | sean-k-mooney: exactly my point | |
| 16:09:29 | bauzas | unless you fucked up with your sudo rights, you shouldn't hit this bug | |
| 16:09:39 | sean-k-mooney[m] | yep | |
| 16:10:02 | sean-k-mooney[m] | its kind of like exposing the docker socket to a container | |
| 16:10:10 | bauzas | so, agreed as Wontfix and leave a note saying we're not against modifying our privsep use, but this is deferred for now ? | |
| 16:10:29 | sean-k-mooney[m] | ok with me | |
| 16:10:40 | bauzas | no objections so far ? | |
| 16:11:03 | gibi | please explain in the bug (if not yet explained) that it cannot lead to escalation if you don't have the rights to spawn the privsep_helper | |
| 16:11:19 | bauzas | gibi: I explained it when I replied but I'll redo it | |
| 16:11:19 | gibi | or talkt to the socket | |
| 16:11:33 | gibi | bauzas: if it is there already then it is OK | |
| 16:11:55 | bauzas | gibi: quote from myself "I agree with all the above. Unless the user is accepted by sudoers to have root priviledges, it can't use privsep to get what they want from the kernel, so this isn't an exploit." | |
| 16:12:07 | gibi | cool then | |
| 16:12:08 | gibi | thanks | |
| 16:12:10 | bauzas | (comment #9) | |
| 16:12:16 | gibi | sorry I not read through the bug | |
| 16:12:23 | bauzas | but I'll make it clear on my last reply | |
| 16:13:16 | bauzas | #agreed https://bugs.launchpad.net/nova/+bug/1989008 to be marked as Wontfix as this isn't a flaw if sudoers is correctly set and we don't know when we can modify our privsep usage in nova yet | |
| 16:13:40 | bauzas | voila, that's it for me unless other pings | |
| 16:14:05 | bauzas | #link https://storyboard.openstack.org/#!/project/openstack/placement 26 open stories (+0 since the last meeting) in Storyboard for Placement | |
| 16:14:12 | bauzas | #info Add yourself in the team bug roster if you want to help https://etherpad.opendev.org/p/nova-bug-triage-roster | |
| 16:14:24 | bauzas | elodilles: still fighting with the release, man ? | |
| 16:14:35 | elodilles | hopefully till tomorrow ;) | |
| 16:14:44 | elodilles | so yes, i can take the baton | |
| 16:14:46 | bauzas | then you have no excuse. | |
| 16:14:52 | bauzas | #info bug baton is being passed to elodilles | |
| 16:14:57 | bauzas | elodilles: thanks | |
| 16:14:57 | elodilles | ~o~ | |
| 16:15:08 | elodilles | np | |
| 16:15:09 | bauzas | elodilles: you won't feel overloaded | |
| 16:15:23 | elodilles | famous last words? :) | |
| 16:15:24 | bauzas | our untriaged backlog is very low todzy | |
| 16:15:48 | elodilles | cool :) | |
| 16:15:56 | bauzas | unless something big happens, like a tornado or a earthquake, you'll be fine (tm) | |
| 16:16:07 | elodilles | :] | |
| 16:16:17 | bauzas | moving on | |
| 16:16:20 | bauzas | #topic Gate status | |
| 16:16:30 | bauzas | #link https://bugs.launchpad.net/nova/+bugs?field.tag=gate-failure Nova gate bugs | |
| 16:16:38 | bauzas | #link https://zuul.openstack.org/builds?project=openstack%2Fplacement&pipeline=periodic-weekly Placement periodic job status | |