Merge lp:~zulcss/heat/heat-mir into lp:~ubuntu-server-dev/heat/icehouse

[Chuck Short]

Changes based on security team feedback.

[lp:~zulcss/heat/heat-mir]

47. By Chuck Short on 2014-04-11

* Fix up packaging based on Ubuntu Security Team review (LP: #1267557):
  - debian/control: Drop python-sendfile since it is no longer
  - debian/heat-common.install: Correct permissions of /etc/heat.
  - debian/patches/suders_patch.patch: Change the directory location

[James Page (james-page)]

78 ++echo -e '%s\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers.d/heat-instnace-%s
79 ++""" % (instance_user, instance_user,instance_user)

instnace -> instance

Other than that +1

review: Approve

[lp:~zulcss/heat/heat-mir]

48. By Chuck Short on 2014-04-14

Fix patch

=== modified file 'debian/changelog'
--- debian/changelog	2014-04-10 14:02:50 +0000
+++ debian/changelog	2014-04-14 13:28:06 +0000
@@ -1,3 +1,15 @@
+heat (2014.1~rc2-0ubuntu2) UNRELEASED; urgency=medium
+
+  * Fix up packaging based on Ubuntu Security Team review (LP: #1267557):
+    - debian/control: Drop python-sendfile since it is no longer
+      needed.
+    - debian/heat-common.install: Correct permissions of /etc/heat.
+    - debian/patches/suders_patch.patch: Change the directory location
+      for the sudoers so that it users the standard /etc/sudoers.d
+      directory.
+
+ -- Chuck Short <[e-mail]>  Fri, 11 Apr 2014 15:25:44 -0400
+
 heat (2014.1~rc2-0ubuntu1) trusty; urgency=medium
 
   * New upstream release candidate (LP: #1299055).

=== modified file 'debian/control'
--- debian/control	2014-03-23 14:04:49 +0000
+++ debian/control	2014-04-14 13:28:06 +0000
@@ -43,7 +43,6 @@
  python-paste,
  python-pastedeploy,
  python-routes,
- python-sendfile,
  python-setuptools,
  python-six,
  python-sphinx,
@@ -88,7 +87,6 @@
  python-paste,
  python-pastedeploy,
  python-routes,
- python-sendfile,
  python-setuptools,
  python-six,
  python-sqlalchemy (>= 0.7.8),

=== modified file 'debian/heat-common.postinst'
--- debian/heat-common.postinst	2013-08-08 13:55:17 +0000
+++ debian/heat-common.postinst	2014-04-14 13:28:06 +0000
@@ -11,7 +11,7 @@
             --shell /bin/false heat
     fi
 	chown -R heat:adm /var/log/heat
-	chmod 0750 /var/log/heat
+	chmod 0750 /var/log/heat /etc/nova
 	mkdir -p /etc/heat
 	mkdir -p /var/lib/heat
 	chown heat:heat -R /var/lib/heat /etc/heat

=== modified file 'debian/patches/series'
--- debian/patches/series	2014-04-10 13:31:46 +0000
+++ debian/patches/series	2014-04-14 13:28:06 +0000
@@ -1,2 +1,3 @@
 default-sqlite.patch
 fix-requirements.patch
+suders_patch.patch

=== added file 'debian/patches/suders_patch.patch'
--- debian/patches/suders_patch.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/suders_patch.patch	2014-04-14 13:28:06 +0000
@@ -0,0 +1,17 @@
+Description: Change sudoers directory to be sudoers.d
+Author: Chuck Short <[e-mail]>
+Forwarded: Not needed.
+diff -Naurp heat-2014.1.rc2.orig/heat/engine/resources/nova_utils.py heat-2014.1.rc2/heat/engine/resources/nova_utils.py
+--- heat-2014.1.rc2.orig/heat/engine/resources/nova_utils.py	2014-04-10 03:27:34.000000000 -0400
++++ heat-2014.1.rc2/heat/engine/resources/nova_utils.py	2014-04-11 15:33:08.870985000 -0400
+@@ -198,8 +198,8 @@ def build_userdata(resource, userdata=No
+         #
+         # See bug https://bugs.launchpad.net/heat/+bug/1257410
+         boothook_custom_user = r"""useradd -m %s
+-echo -e '%s\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers
+-""" % (instance_user, instance_user)
++echo -e '%s\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers.d/heat-instacce-%s
++""" % (instance_user, instance_user,instance_user)
+     else:
+         config_custom_user = ''
+         boothook_custom_user = ''