Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2022-10-04
16:05:47 bauzas but we prefer deferring to the host config
16:05:58 bauzas about the permissions rights
16:06:01 sean-k-mooney[m] so longterm i think we shoudl rewirte how we use privesep
16:06:14 bauzas I don't disagree
16:06:19 sean-k-mooney[m] but i dont think we will have time in A
16:06:24 bauzas but this is a long-term effort
16:06:32 bauzas yeah and very tedious effort
16:06:53 sean-k-mooney[m] i personally would not mind tipping away at this over time
16:07:04 bauzas for that reason, I think this is valid to close this bug as Wontfix
16:07:05 sean-k-mooney[m] but not sure i can do it in A
16:07:17 bauzas as this is actually more a request for enhancement than a really butg
16:07:20 bauzas bug*
16:07:38 sean-k-mooney[m] i have no objection to that as its really a speless blueprint or spec in my view
16:07:57 bauzas of course, deployers and openstack distros need to properly care about this bug
16:08:08 bauzas and make sure the rights they give are correctly set
16:08:19 sean-k-mooney[m] its not quite an architectual change but it is a desgin pattern change
16:08:31 bauzas but from an upstream perspective, given no further effort can be simply made, we need to close it
16:08:42 bauzas sean-k-mooney: yeah a refactoring change
16:08:45 bauzas but,
16:08:51 sean-k-mooney[m] so currently it cannot lead to privladge escalation if you dont already have the ablity to spwan the privsep helper
16:08:57 sean-k-mooney[m] or have access to the unix socket of an exsiting one
16:08:58 bauzas sean-k-mooney: we correctly need to make it
16:09:09 bauzas sean-k-mooney: exactly my point
16:09:29 bauzas unless you fucked up with your sudo rights, you shouldn't hit this bug
16:09:39 sean-k-mooney[m] yep
16:10:02 sean-k-mooney[m] its kind of like exposing the docker socket to a container
16:10:10 bauzas so, agreed as Wontfix and leave a note saying we're not against modifying our privsep use, but this is deferred for now ?
16:10:29 sean-k-mooney[m] ok with me
16:10:40 bauzas no objections so far ?
16:11:03 gibi please explain in the bug (if not yet explained) that it cannot lead to escalation if you don't have the rights to spawn the privsep_helper
16:11:19 gibi or talkt to the socket
16:11:19 bauzas gibi: I explained it when I replied but I'll redo it
16:11:33 gibi bauzas: if it is there already then it is OK
16:11:55 bauzas gibi: quote from myself "I agree with all the above. Unless the user is accepted by sudoers to have root priviledges, it can't use privsep to get what they want from the kernel, so this isn't an exploit."
16:12:07 gibi cool then
16:12:08 gibi thanks
16:12:10 bauzas (comment #9)
16:12:16 gibi sorry I not read through the bug
16:12:23 bauzas but I'll make it clear on my last reply
16:13:16 bauzas #agreed https://bugs.launchpad.net/nova/+bug/1989008 to be marked as Wontfix as this isn't a flaw if sudoers is correctly set and we don't know when we can modify our privsep usage in nova yet
16:13:40 bauzas voila, that's it for me unless other pings
16:14:05 bauzas #link https://storyboard.openstack.org/#!/project/openstack/placement 26 open stories (+0 since the last meeting) in Storyboard for Placement
16:14:12 bauzas #info Add yourself in the team bug roster if you want to help https://etherpad.opendev.org/p/nova-bug-triage-roster
16:14:24 bauzas elodilles: still fighting with the release, man ?
16:14:35 elodilles hopefully till tomorrow ;)
16:14:44 elodilles so yes, i can take the baton
16:14:46 bauzas then you have no excuse.
16:14:52 bauzas #info bug baton is being passed to elodilles
16:14:57 elodilles ~o~
16:14:57 bauzas elodilles: thanks
16:15:08 elodilles np
16:15:09 bauzas elodilles: you won't feel overloaded
16:15:23 elodilles famous last words? :)
16:15:24 bauzas our untriaged backlog is very low todzy
16:15:48 elodilles cool :)
16:15:56 bauzas unless something big happens, like a tornado or a earthquake, you'll be fine (tm)
16:16:07 elodilles :]
16:16:17 bauzas moving on
16:16:20 bauzas #topic Gate status
16:16:30 bauzas #link https://bugs.launchpad.net/nova/+bugs?field.tag=gate-failure Nova gate bugs
16:16:38 bauzas #link https://zuul.openstack.org/builds?project=openstack%2Fplacement&pipeline=periodic-weekly Placement periodic job status
16:16:46 bauzas link https://zuul.openstack.org/builds?job_name=tempest-integrated-compute-centos-9-stream&project=openstack%2Fnova&pipeline=periodic-weekly Centos 9 Stream periodic job status
16:16:49 bauzas damn
16:16:52 bauzas #link https://zuul.openstack.org/builds?job_name=tempest-integrated-compute-centos-9-stream&project=openstack%2Fnova&pipeline=periodic-weekly Centos 9 Stream periodic job status
16:17:00 bauzas #link https://zuul.opendev.org/t/openstack/builds?job_name=nova-emulation&pipeline=periodic-weekly&skip=0 Emulation periodic job runs
16:17:08 bauzas all green above ^
16:17:38 bauzas well, actually https://zuul.openstack.org/builds?project=openstack%2Fplacement&pipeline=periodic-weeklyhttps://zuul.openstack.org/builds?project=openstack%2Fplacement&pipeline=periodic-weekly is still fetching info
16:17:52 bauzas anyone having the same trouble than me when opening the url ?
16:17:59 sean-k-mooney[m] you could just have one linke to the perodic pipeline
16:18:08 bauzas right
16:18:29 sean-k-mooney[m] https://zuul.opendev.org/t/openstack/builds?pipeline=periodic-weekly&skip=0
16:18:35 sean-k-mooney[m] they work ok for me
16:18:49 bauzas sean-k-mooney: so you basically let me providing those 3 links for the whole Yoga and Zed releases ?
16:18:57 bauzas meh p
16:18:59 bauzas :p
16:19:26 sean-k-mooney[m] https://zuul.opendev.org/t/openstack/builds?project=openstack%2Fnova&project=openstack%2Fplacement&pipeline=periodic-weekly&skip=0
16:19:30 sean-k-mooney[m] hehe
16:19:42 sean-k-mooney[m] that one is nova and placment weekly jobs in one link
16:20:03 bauzas yeah, I never reconsidered to make one call once we added the two other checks :)
16:20:04 sean-k-mooney[m] anyway the are looking good so we can move on
16:20:08 bauzas yeah, moving on
16:20:11 bauzas but this was fun
16:20:21 bauzas stupid me.
16:20:38 bauzas #info Please look at the gate failures and file a bug report with the gate-failure tag.
16:20:44 bauzas #info STOP DOING BLIND RECHECKS aka. 'recheck' https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures
16:21:17 bauzas fyi, I think I'll start providing the weekly metrics for the recheck command in the nova project if our stats don't improve :)
16:22:07 gmann there is one TC monitor https://etherpad.opendev.org/p/recheck-weekly-summary
16:22:12 bauzas https://etherpad.opendev.org/p/recheck-weekly-summary tells me we're at 50%
16:22:21 bauzas damn, burned by gmann
16:22:46 gmann :) thanks to slaweq
16:22:48 bauzas gmann: yeah I know and I feel 50% is a too bug number
16:22:50 bauzas big
16:23:16 gmann but its 1 out of 2
16:23:18 sean-k-mooney[m] so at this point im not sure reminding people each week is helping
16:23:36 gmann 1 bare recheck is still not so bad
16:23:38 bauzas if my daughter was ranked 10/20 (this is a french note over 20 points), I'd ask her to change a few things
16:24:32 bauzas actually, nevermind me
16:24:40 bauzas I just saw the raw stats
16:24:41 sean-k-mooney[m] can i suggest we drop this form the meeting going forward or talk about it at the ptg
16:24:46 bauzas yeah

Earlier   Later