| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-14 | |||
| 18:25:57 | sean-k-mooney | it only uses the condutor to talk to the scheduler, db and conductor itslef | |
| 18:26:38 | noonedeadpunk | We in #openstack-ansible were just asked what can be done http://seclab.cs.sunysb.edu/seclab/pubs/asiaccs16.pdf and it feels what they write about RPC is a bit stupid since you have keystone admin credentials stored on each compute... | |
| 18:27:11 | sean-k-mooney | you dont nessisarly have keystone admin creds | |
| 18:27:31 | sean-k-mooney | in fact you shoudl not have keystone admin creds | |
| 18:27:32 | noonedeadpunk | well, ok, service creds | |
| 18:27:45 | noonedeadpunk | but it would still have kind of admin privileges? | |
| 18:27:45 | sean-k-mooney | ok yes | |
| 18:27:57 | sean-k-mooney | iddeally you woudl use application credentils | |
| 18:28:22 | sean-k-mooney | am yes nova need to all some other services as admin | |
| 18:28:24 | noonedeadpunk | so the idea there was - how much you fucked if one compute node is hacked :) | |
| 18:28:35 | sean-k-mooney | but those service creditely shoudl only give admin on those spercices | |
| 18:29:09 | sean-k-mooney | it depend on what you put there | |
| 18:29:30 | sean-k-mooney | if you use app creds you can avoid using a password in your config | |
| 18:29:37 | noonedeadpunk | I don't think it's still smth that keystone has out of the box? I mean even with all these scoped tokens you would still need to mess up with policies to get yourself covered? | |
| 18:29:37 | sean-k-mooney | which makes revocation simpler | |
| 18:30:02 | noonedeadpunk | like credential per compute... hm... | |
| 18:30:10 | noonedeadpunk | that's interesting idea | |
| 18:30:23 | sean-k-mooney | yep you can do cred per service per compute today | |
| 18:30:29 | sean-k-mooney | if you really want too | |
| 18:31:02 | sean-k-mooney | also if you are deploying in contiaenr you dont need the nova.conf to be visable to the nova_libvirt container | |
| 18:31:33 | sean-k-mooney | so even if you break out of the vm you then have to also escap the container and selix and the file permisions to read the config file | |
| 18:31:49 | sean-k-mooney | at least with ooo that is | |
| 18:32:24 | sean-k-mooney | so for ooo the vms are runing itn the filesystem namesapce of nova_libvirt as the qemu user | |
| 18:32:33 | sean-k-mooney | that contaienr does not have the nova.conf visable to it | |
| 18:32:55 | sean-k-mooney | and selinux + file system permission woudl prevent the vm process form reading it | |
| 18:32:58 | clarkb | wouldn't that be true for any setup running libvirt as not the nova user and basic file permissions? | |
| 18:33:00 | clarkb | ya that | |
| 18:33:23 | clarkb | however libvirt is privileged | |
| 18:33:25 | noonedeadpunk | yeah, I guess in ubuntu apparmour does kind of same anyway | |
| 18:33:31 | clarkb | so might be defeatable? | |
| 18:33:34 | sean-k-mooney | yep even in a normal rpm/deb install selinux/apparmor + file system permisions can help | |
| 18:33:41 | melwitt | thanks gmann++ | |
| 18:33:59 | sean-k-mooney | clarkb: libvirt is but qemu does not run with the same user or group as libvirt | |
| 18:34:05 | clarkb | aha got it | |
| 18:34:44 | noonedeadpunk | but yeah, I got the idea:) At least I thought that we do smth stupid by placing access to keystone in nova-compute.conf but no, it's required) | |
| 18:34:45 | opendevreview | Merged openstack/nova master: Add regression test for bug #1937084 https://review.opendev.org/c/openstack/nova/+/812126 | |
| 18:34:51 | sean-k-mooney | so in general qemu shoudl not be part of the nova group so should not be able to read nova config files | |
| 18:35:51 | sean-k-mooney | nova is often part of the qemu/libvirt group but that direction makes sense | |
| 18:36:26 | sean-k-mooney | since nova need to be able to talk to libvirt at least and create files that qemu can read | |
| 18:37:32 | melwitt | lyarwood: in case you didn't see, I addressed your comments on https://review.opendev.org/c/openstack/python-openstackclient/+/818306 | |
| 18:38:18 | sean-k-mooney | noonedeadpunk: so ya i have not read that paper but im not sure how valid it is and if they have correctly deployed thigns | |
| 18:39:31 | sean-k-mooney | noonedeadpunk: with devstack for example most thigns are owned by the stack user so the filesystem doesnt do much for you but opensack ansible, kolla or ooo should provide much more protection | |
| 18:40:25 | noonedeadpunk | wasnt it reading in details, but yeah, it weird, as they read nova.conf, get rabbitmq creds, then were snifffing tokens (why when they could jsut take that from keystone_authotoken?) | |
| 18:40:57 | noonedeadpunk | but yeah, I got idea, thanks sean-k-mooney a lot! | |
| 18:41:19 | noonedeadpunk | as always, I got bunch of good ideas how to improve things) | |
| 18:43:30 | sean-k-mooney | noonedeadpunk: looking at https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/nova_pre_install.yml#L85-L121 by the way it looks like osa is already creating /etc/nova in the nova user and group | |
| 18:43:47 | noonedeadpunk | yep, sure we do that! | |
| 18:43:50 | sean-k-mooney | you likely dont want to use 755 for the mode | |
| 18:43:52 | sean-k-mooney | https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/nova_pre_install.yml#L92 | |
| 18:44:04 | sean-k-mooney | since that is world readable | |
| 18:44:14 | noonedeadpunk | good point | |
| 18:44:15 | sean-k-mooney | say 750 | |
| 18:44:38 | sean-k-mooney | or 650 for files | |
| 18:45:05 | noonedeadpunk | we should totally review that asap... | |
| 18:45:34 | noonedeadpunk | nova.conf is stored 0640 though | |
| 18:45:46 | sean-k-mooney | ack then its likely fin already | |
| 18:45:54 | sean-k-mooney | nova is part fo the libvirt group https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/drivers/kvm/nova_compute_kvm.yml#L56-L63 | |
| 18:45:54 | noonedeadpunk | https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/nova_post_install.yml#L58-L81 | |
| 18:45:57 | sean-k-mooney | which is corrct | |
| 18:46:08 | sean-k-mooney | and i dont see qemu or libvirt beign added to nova | |
| 18:46:18 | sean-k-mooney | so for osa they should not be able to read the nova.conf | |
| 18:47:27 | noonedeadpunk | yep, thanks a lot for checking that! We still should review directory permissions | |
| 18:54:02 | sean-k-mooney | no worries, security is important | |
| 18:54:28 | sean-k-mooney | eventually i hope ooo or some of the installer will start using https://docs.openstack.org/keystone/queens/user/application_credentials.html | |
| 18:54:39 | sean-k-mooney | in the config | |
| 18:58:25 | noonedeadpunk | I wish there was an ansible module ready for that... Shouldn't be that hard to write one though | |
| 19:01:10 | noonedeadpunk | but we have huge backlog of missed features anyway now :( we still haven't managed to implement service_tokens https://docs.openstack.org/keystone/latest/admin/manage-services.html#configuring-service-tokens | |
| 19:04:15 | noonedeadpunk | but the biggest issue I see with application credentials - is how to template config. So they should be stored somewhere after being created and managed... | |
| 19:15:13 | noonedeadpunk | and kind of rotating of regular credentials is not _that_ hard - a matter of re-running playbook with specific tags.... | |
| 19:15:55 | noonedeadpunk | I think the most challendging thing is to get aware that they got compromised | |
| 19:37:33 | opendevreview | Ade Lee proposed openstack/nova master: Add check job for FIPS https://review.opendev.org/c/openstack/nova/+/790519 | |
| 21:02:30 | opendevreview | Merged openstack/nova master: Make API fixture pass roles https://review.opendev.org/c/openstack/nova/+/819907 | |
| 22:27:57 | opendevreview | Merged openstack/nova master: Update Interop doc https://review.opendev.org/c/openstack/nova/+/816980 | |
| 22:28:04 | opendevreview | Merged openstack/nova master: api-ref: Adjust BFV rescue non-support note. https://review.opendev.org/c/openstack/nova/+/818823 | |
| #openstack-nova - 2022-01-15 | |||
| 02:58:47 | gmann | sean-k-mooney: i do not think neutron enforce scope by default. where you have seen that? | |
| 03:36:42 | sean-k-mooney[m] | in the error messageage int the log it was coplaining about token scope | |
| 08:42:26 | gibi | gmann: thanks | |
| 09:07:23 | frickler | maybe you should stop approving things while the gate is known broken. nova is currently holding up the integrated queue big time with their gate resets | |
| 10:54:05 | gibi | frickler: I not expect too much approval during the weekend, I can send a mail on the Monday to the ML if we still need to hold the approvals | |
| #openstack-nova - 2022-01-16 | |||
| 14:33:10 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 14:34:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 14:45:03 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 14:49:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 20:56:29 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add PCI VPD Capability Handling https://review.opendev.org/c/openstack/nova/+/808199 | |
| 20:56:30 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: Filter computes without remote-managed ports early https://review.opendev.org/c/openstack/nova/+/812111 | |
| 20:56:30 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Include pf mac and vf num in port updates https://review.opendev.org/c/openstack/nova/+/824833 | |
| 20:56:31 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Introduce remote_managed tag for PCI devices https://review.opendev.org/c/openstack/nova/+/824834 | |
| 20:56:31 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add support for VNIC_TYPE_SMARTNIC https://review.opendev.org/c/openstack/nova/+/824835 | |
| #openstack-nova - 2022-01-17 | |||
| 00:52:42 | gmann | sean-k-mooney: no, neutron is not forcing scope. it is only warning in logs when enforce_scope is disabled. if enable the it fail with 403 not warning. that is from oslo side. | |
| 01:33:10 | opendevreview | Ghanshyam proposed openstack/nova master: Test PROJECT_ADMIN APIs with no legacy rule case https://review.opendev.org/c/openstack/nova/+/824845 | |
| 02:06:08 | opendevreview | Ghanshyam proposed openstack/nova master: Move rule_if_system() method to base test class https://review.opendev.org/c/openstack/nova/+/824475 | |
| 02:06:25 | opendevreview | Ghanshyam proposed openstack/nova master: Convert SYSTEM_ADMIN|READER to Admin and system scope https://review.opendev.org/c/openstack/nova/+/819390 | |
| 02:06:45 | opendevreview | Ghanshyam proposed openstack/nova master: Server actions APIs scoped to project scope https://review.opendev.org/c/openstack/nova/+/824358 | |
| 02:09:53 | opendevreview | Ghanshyam proposed openstack/nova master: Server actions APIs scoped to project scope https://review.opendev.org/c/openstack/nova/+/824358 | |
| 04:25:53 | opendevreview | Merged openstack/nova master: Fill the AcceleratorRequestBindingFailed exception msg info https://review.opendev.org/c/openstack/nova/+/817326 | |
| 07:49:13 | tkajinam | hello. I'd appreciate your attention to https://review.opendev.org/c/openstack/nova/+/824830 . we need this to fix package dependency in rdo, which is currently blocking CI jobs in some puppet module repos | |
| 08:03:10 | bauzas | tkajinam: ack, will look | |
| 08:06:02 | tkajinam | bauzas, thank you ! | |
| 08:51:42 | bauzas | gibi: other cores, 'd appreciate a quick +W on https://review.opendev.org/c/openstack/nova/+/824830 which fixes a critical bug | |
| 08:52:00 | bauzas | stephenfin: also, if you have time | |