[Openstack-security] [Bug 1611171] Fix included in openstack/ec2-api 7.0.0
This issue was fixed in the openstack/ec2-api 7.0.0 release.
You received this bug notification because you are a member of OpenStack
Security SIG, which is subscribed to OpenStack.
re-runs self via sudo
Status in Cinder:
Status in Designate:
Status in ec2-api:
Status in gce-api:
Status in Manila:
Status in masakari:
Status in OpenStack Compute (nova):
Status in OpenStack Compute (nova) newton series:
Status in OpenStack Security Advisory:
Status in Rally:
Hello, I'm looking through Designate source code to determine if is
appropriate to include in Ubuntu Main. This isn't a full security
This looks like trouble:
cfgfile = CONF.config_file[-1] if CONF.config_file else None
if cfgfile and not os.access(cfgfile, os.R_OK):
st = os.stat(cfgfile)
print(_("Could not read %s. Re-running with sudo") % cfgfile)
os.execvp('sudo', ['sudo', '-u', '#%s' % st.st_uid] + sys.argv)
print(_('sudo failed, continuing as if nothing happened'))
print(_('Please re-run designate-manage as root.'))
This is an interesting decision -- if the configuration file is _not_ readable by the user in question, give the executing user complete privileges of the user that owns the unreadable file.
I'm not a fan of hiding privilege escalation / modifications in
programs -- if a user had recently used sudo and thus had the
authentication token already stored for their terminal, this 'hidden'
use of sudo may be unexpected and unwelcome, especially since it
appears that argv from the first call leaks through to the sudo call.
Is this intentional OpenStack style? Or unexpected for you guys too?
(Feel free to make this public at your convenience.)
To manage notifications about this bug go to: