Juju Charms Collection
ceilometer package

ceilometer charm creates world-readable /etc/ceilometer/ceilometer.conf, exposing credentials

Bug #1588391 reported by Paul Gear
272
This bug affects 4 people
Affects Status Importance Assigned to Milestone
OpenStack Ceilometer Charm
Invalid
High
Liam Young
Ubuntu Cloud Archive
Fix Released
High
Corey Bryant
ceilometer (Juju Charms Collection)
Invalid
High
Liam Young
Juju Charms Collection 17.01
ceilometer (Ubuntu)
Fix Released
High
Corey Bryant

Bug Description

On a newly-installed system using ceilometer from the charm store, /etc/ceilometer/ceilometer.conf is world-readable, despite holding a number of important credentials:

ubuntu@juju-machine-131-lxc-2:/etc/ceilometer$ ls -la /etc/ceilometer/ceilometer.conf
-rw-r--r-- 1 ceilometer ceilometer 1140 Jun 2 14:12 /etc/ceilometer/ceilometer.conf

Permissions should be changed to 0640 at a maximum.

See original description
Paul Gear (paulgear)
description: updated
Ryan Beisner (1chb1n)
affects: charms → ceilometer (Juju Charms Collection)
Liam Young (gnuoy)
Changed in ceilometer (Juju Charms Collection):
status: New → Confirmed
importance: Undecided → High
assignee: nobody → Liam Young (gnuoy)
milestone: none → 17.01
Revision history for this message
Liam Young (gnuoy) wrote :

I think it's the /etc/ceilometer directory which should be 750 rather than 755

Revision history for this message
Chuck Short (zulcss) wrote :

Set to 0700 as the other packages.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ceilometer (Ubuntu):
status: New → Confirmed
Xav Paice (xavpaice)
tags: added: canonical-bootstack
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ceilometer - 1:8.0.0-0ubuntu5

---------------
ceilometer (1:8.0.0-0ubuntu5) zesty; urgency=medium

  * debian/control: Really fix adjustements.

 -- Chuck Short <email address hidden> Fri, 10 Feb 2017 10:06:55 -0500

Changed in ceilometer (Ubuntu):
status: Confirmed → Fix Released
James Page (james-page)
Changed in charm-ceilometer:
assignee: nobody → Liam Young (gnuoy)
importance: Undecided → High
status: New → Confirmed
Changed in ceilometer (Juju Charms Collection):
status: Confirmed → Invalid
Revision history for this message
Corey Bryant (corey.bryant) wrote :

This particular issue wasn't actually fixed in the ceilometer package, so moving back to in progress.

Changed in ceilometer (Ubuntu):
status: Fix Released → Triaged
status: Triaged → In Progress
Revision history for this message
Corey Bryant (corey.bryant) wrote :

I've pushed the fix for this to https://code.launchpad.net/~ubuntu-server-dev/ubuntu/+source/ceilometer/+git/ceilometer.

However, I attempted to upload the package but it was rejected because there is now an 8.0.1 version of ceilometer in zesty, which wasn't pushed to the git repo, so now the git repo is out of sync.

Chuck, I'm leaving this for you to fix up.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ceilometer - 1:8.0.1-0ubuntu2

---------------
ceilometer (1:8.0.1-0ubuntu2) zesty; urgency=medium

  * d/ceilometer-commmon.postinst: Set permissions to 0640 for
    /etc/ceilometer/ceilometer.conf (LP: #1588391).

 -- Corey Bryant <email address hidden> Thu, 16 Mar 2017 10:19:40 -0400

Changed in ceilometer (Ubuntu):
status: In Progress → Fix Released
Revision history for this message
Corey Bryant (corey.bryant) wrote :

This is fixed now in the ceilometer package which is currently in zesty-proposed and xenial-staging. I've tested with the charm and ceilometer.conf perms remain at 0640.

-rw-r----- 1 ceilometer ceilometer 590 Mar 16 15:47 ceilometer.conf

Corey Bryant (corey.bryant)
Changed in charm-ceilometer:
status: Confirmed → Invalid
Changed in cloud-archive:
importance: Undecided → High
Changed in ceilometer (Ubuntu):
importance: Undecided → High
Changed in cloud-archive:
assignee: nobody → Corey Bryant (corey.bryant)
Changed in ceilometer (Ubuntu):
assignee: nobody → Corey Bryant (corey.bryant)
Changed in cloud-archive:
status: New → Fix Committed
Chris MacNaughton (chris.macnaughton)
Changed in cloud-archive:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.