34713f3b52
The sudoers files as installed with openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal with ".." which grants full passwordless root access to the validations user. Change-Id: I34073671c8f97d7bfbe1030ed52e6627a07dacfb Related-Bug: 1705709
11 lines
771 B
Plaintext
11 lines
771 B
Plaintext
Defaults!/usr/bin/run-validation !requiretty
|
|
Defaults:validations !requiretty
|
|
Defaults:mistral !requiretty
|
|
mistral ALL = (validations) NOPASSWD:SETENV: /usr/bin/run-validation
|
|
mistral ALL = NOPASSWD: /usr/bin/chown -h validations\: /tmp/validations_identity_[A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_], \
|
|
!/usr/bin/chown /tmp/validations_identity_* *, !/usr/bin/chown /tmp/validations_identity_*..*
|
|
mistral ALL = NOPASSWD: /usr/bin/rm -f /tmp/validations_identity_[A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_], \
|
|
!/usr/bin/rm /tmp/validations_identity_* *, !/usr/bin/rm /tmp/validations_identity_*..*
|
|
mistral ALL = NOPASSWD: /bin/nova-manage cell_v2 discover_hosts *
|
|
validations ALL = NOPASSWD: ALL
|