)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9a54e02d6b1b5447216296314a08664090644b61","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Nathaniel Dillon \u003cnathaniel.dillon@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-09-04 13:14:00 -0700"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Submitting new OSSN concerning Swift/Glance public images"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"New OpenStack Security Note concerning Swift and Glance"},{"line_number":10,"context_line":"Removing line whitespace"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"fa98f980_48c03c50","line":7,"updated":"2014-09-12 04:34:24.000000000","message":"(nit) Add the OSSN number to the subject.  It makes it easier to go through git shortlog output in the future.","commit_id":"78bc6cb41a9b88227faf40e609990ab920ff1a76"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9a54e02d6b1b5447216296314a08664090644b61","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Removing line whitespace"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ic61b2fa276a21e1617f90a3ce64f9e5972ff24bb"},{"line_number":13,"context_line":"Partial-Bug: #1354512"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"fa98f980_68b18000","line":13,"updated":"2014-09-12 04:34:24.000000000","message":"You should make this \"Closes-bug\".  It will only affect the OSSN portion of the bug.","commit_id":"78bc6cb41a9b88227faf40e609990ab920ff1a76"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"92202ce47cd3b9d395a901757e3412d768880908","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Complete re-write adding more details"},{"line_number":10,"context_line":"Added section on root cause - public label in Swift vs Glance"},{"line_number":11,"context_line":"Added details on fixes and their possible impacts"},{"line_number":12,"context_line":"Removed reference to patch that has not yet been reviewed"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Ic61b2fa276a21e1617f90a3ce64f9e5972ff24bb"},{"line_number":15,"context_line":"Closes-Bug: #1354512"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"fa98f980_7aac949f","line":12,"updated":"2014-09-16 07:36:44.000000000","message":"Please rewrite the commit message. I think you abandoned the other review requests. This has not to be mentioned in the commit message because the review requests are not tracked in the Git log.","commit_id":"5aad599e61b46ec12cc8a4721fa9fb8dc78f33d5"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"ed07e06f70375cae737782b777126e07c1a9982a","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     dillonn \u003cnathaniel.dillon@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-10-13 11:04:45 -0700"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Re-submitting OSSN 25 oncerning Swift/Glance public images"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Complete re-write adding more details"},{"line_number":10,"context_line":"Added section on root cause - public label in Swift vs Glance"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"baa201ad_1c394f41","line":7,"updated":"2014-10-14 13:08:37.000000000","message":"concerning","commit_id":"65367905fb55ea5f6fcba65abeeb9f4c3317543e"}],"security-notes/OSSN-0025":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"370f3b03918ba0e1596f8cf1b225b156451e984c","unresolved":false,"context_lines":[{"line_number":28,"context_line":"When these configurations are loaded into an OpenStack configuration"},{"line_number":29,"context_line":"a public image A can have a snapshot B created from image A. Given the"},{"line_number":30,"context_line":"path to snapshot B and the owner ID of image A, the Swift URL for the"},{"line_number":31,"context_line":"public image can be re-created and is accessible to any user or "},{"line_number":32,"context_line":"resource on the same network."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"fa98f980_d430d058","line":31,"updated":"2014-09-01 11:26:22.000000000","message":"trailing whitespace","commit_id":"a4ab79b12299c16da4a78dda77640e0c56735c40"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9a54e02d6b1b5447216296314a08664090644b61","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Contacts / References ###"},{"line_number":46,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0025"},{"line_number":47,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1354512"},{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"fa98f980_0899d478","line":47,"updated":"2014-09-12 04:34:24.000000000","message":"This link should be to the Glance bug, not the OSSN bug:\n\n    https://bugs.launchpad.net/glance/+bug/1354512","commit_id":"78bc6cb41a9b88227faf40e609990ab920ff1a76"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3e02f366aa46be405cbfe6bf6fbc771c12134a1e","unresolved":false,"context_lines":[{"line_number":6,"context_line":"When Glance uses Swift as backend, and Swift uses delay_auth_decision"},{"line_number":7,"context_line":"feature (for temporary URLs, for example), creating a Glance snapshot"},{"line_number":8,"context_line":"can allow the public image URL to be extrapolated, and allows anonymous"},{"line_number":9,"context_line":"access to anyone who knows the URL."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Glance, Swift, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"fa98f980_8077f49e","line":9,"updated":"2014-09-16 18:23:38.000000000","message":"This is a bit of a run-on sentence.  Maybe something like: \n\n\"When Glance uses Swift as a backend, and Swift uses the \u0027delay_auth_decision\u0027 setting, an unauthenticated user can access a public image by URL.\" ...","commit_id":"5aad599e61b46ec12cc8a4721fa9fb8dc78f33d5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3e02f366aa46be405cbfe6bf6fbc771c12134a1e","unresolved":false,"context_lines":[{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Glance and Swift interpret public two different ways. Public Glance"},{"line_number":16,"context_line":"images are accessible to any tenant, while public Swift containers are"},{"line_number":17,"context_line":"accessible to all users under certain conditions. This can expose"},{"line_number":18,"context_line":"images when they are configured in the following fashion:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Swift proxy-server.conf"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"fa98f980_c0cd7cb9","line":17,"updated":"2014-09-16 18:23:38.000000000","message":"can we make it a little bit more clear what the difference is here?  Accessible to any tenant with network access?  Swift containers all accessible to all authenticated users?","commit_id":"5aad599e61b46ec12cc8a4721fa9fb8dc78f33d5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3e02f366aa46be405cbfe6bf6fbc771c12134a1e","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    delay_auth_decision \u003d 1"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Glance glance-api.conf"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    default_store \u003d swift"},{"line_number":27,"context_line":"    swift_store_multi_tenant \u003d True"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"fa98f980_c0449c1d","line":24,"updated":"2014-09-16 18:23:38.000000000","message":"Use snippets here","commit_id":"5aad599e61b46ec12cc8a4721fa9fb8dc78f33d5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3e02f366aa46be405cbfe6bf6fbc771c12134a1e","unresolved":false,"context_lines":[{"line_number":30,"context_line":"When these configurations are loaded into an OpenStack configuration"},{"line_number":31,"context_line":"a public image A can have a snapshot B created from image A. Given the"},{"line_number":32,"context_line":"path to snapshot B and the owner ID of image A, the Swift URL for the"},{"line_number":33,"context_line":"public image can be re-created. This URL can then be utilized"},{"line_number":34,"context_line":"anonymously to download the image."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"fa98f980_4050acd4","line":33,"updated":"2014-09-16 18:23:38.000000000","message":"maybe say \"inferred\" rather than re-created","commit_id":"5aad599e61b46ec12cc8a4721fa9fb8dc78f33d5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3e02f366aa46be405cbfe6bf6fbc771c12134a1e","unresolved":false,"context_lines":[{"line_number":37,"context_line":"By default, Swift logging is enabled and can be used to audit Swift"},{"line_number":38,"context_line":"image requests to determine if an image is accessed, and if so which"},{"line_number":39,"context_line":"image is accessed. By default these log messages go to the"},{"line_number":40,"context_line":"/var/log/syslog file."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"The Swift and Glance configuration items are specific to a given"},{"line_number":43,"context_line":"environment, so test configurations before deploying them in a"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"fa98f980_e06fe091","line":40,"updated":"2014-09-16 18:23:38.000000000","message":"enclose the path in \u0027 \u0027","commit_id":"5aad599e61b46ec12cc8a4721fa9fb8dc78f33d5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3e02f366aa46be405cbfe6bf6fbc771c12134a1e","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Modifying Glance to not use Swift will mitigate the issue, but may"},{"line_number":49,"context_line":"introduce other issues depending on what is used. Setting the"},{"line_number":50,"context_line":"swift_store_multi_tenant option to False will mitigate the issue, but"},{"line_number":51,"context_line":"will also not allow a multi-tenant environment."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"fa98f980_6003f0be","line":50,"updated":"2014-09-16 18:23:38.000000000","message":"surround the value False in \u0027 \u0027","commit_id":"5aad599e61b46ec12cc8a4721fa9fb8dc78f33d5"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8f74b1c66497d250043254bc3a0b7f61536ca274","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Glance, Swift, Havana, Icehouse"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Glance and Swift interpret public two different ways. Public Glance"},{"line_number":14,"context_line":"images are accessible to any authenticated tenant, while public Swift"},{"line_number":15,"context_line":"containers can be accessible to all users. This can expose images when"},{"line_number":16,"context_line":"they are configured in the following fashion:"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_5b66a4bc","line":13,"updated":"2014-09-18 17:12:39.000000000","message":"Confusing sentence, you\u0027re talking about the concept here right?","commit_id":"b84d54eccf67b9349ef96661d2a74b5a1dbb8595"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3b75f45d306449ddde69c699f9ca1b965da951a7","unresolved":false,"context_lines":[{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Images in Glance that are labeled as public are accessible to any"},{"line_number":14,"context_line":"authenticated tenant, while public Swift containers can be accessible"},{"line_number":15,"context_line":"to all users. When Glance is configured in multi-tenant mode to use"},{"line_number":16,"context_line":"Swift as a back end, and Swift has the delay_auth_decision value set"},{"line_number":17,"context_line":"the URL of the original Swift image can be inferred to allow anonymous"},{"line_number":18,"context_line":"access to the image."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da9df570_5d13f565","line":15,"updated":"2014-09-23 20:26:15.000000000","message":"+1.  It would be good to say \"regardless of authentication\", or \"even if unauthenticated\" here.","commit_id":"3869c8ac90bebbfd11dc0a7aaac462bd8a92570b"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f8ddd57db7b736785231909e238a9a3e6226bb01","unresolved":false,"context_lines":[{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Images in Glance that are labeled as public are accessible to any"},{"line_number":14,"context_line":"authenticated tenant, while public Swift containers can be accessible"},{"line_number":15,"context_line":"to all users. When Glance is configured in multi-tenant mode to use"},{"line_number":16,"context_line":"Swift as a back end, and Swift has the delay_auth_decision value set"},{"line_number":17,"context_line":"the URL of the original Swift image can be inferred to allow anonymous"},{"line_number":18,"context_line":"access to the image."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da9df570_c10aa520","line":15,"updated":"2014-09-23 17:43:28.000000000","message":"rather than say \"all users\" maybe something more specific, \"anybody with network access can access Swift containers directly via URL\"","commit_id":"3869c8ac90bebbfd11dc0a7aaac462bd8a92570b"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f8ddd57db7b736785231909e238a9a3e6226bb01","unresolved":false,"context_lines":[{"line_number":17,"context_line":"the URL of the original Swift image can be inferred to allow anonymous"},{"line_number":18,"context_line":"access to the image."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"The is done when Swift and Glance are configured in the following"},{"line_number":21,"context_line":"fashion:"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Swift proxy-server.conf"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da9df570_213d31bc","line":20,"updated":"2014-09-23 17:43:28.000000000","message":"Maybe: \"This may happen when\" rather than \"This is done\"\nAlso: I assume you mean \"This is done\" rather than \"The\" :)","commit_id":"3869c8ac90bebbfd11dc0a7aaac462bd8a92570b"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f8ddd57db7b736785231909e238a9a3e6226bb01","unresolved":false,"context_lines":[{"line_number":34,"context_line":"swift_store_create_container_on_put \u003d True"},{"line_number":35,"context_line":"---- end example glance-api.conf snippet ----"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"When these configurations are loaded into an OpenStack configuration"},{"line_number":38,"context_line":"a public image A can have a snapshot B created from image A. Given the"},{"line_number":39,"context_line":"path to snapshot B and the owner ID of image A, the Swift URL for the"},{"line_number":40,"context_line":"public image can be inferred. This URL can then be utilized"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da9df570_01974d91","line":37,"updated":"2014-09-23 17:43:28.000000000","message":"This makes it sound like the whole snapshot process is required for the problem to happen.  Really, if I understand it right, it\u0027s just an example for how the URL can be inferred.  I think it just complicates the issue.  Maybe we can say \"The URL can be inferred.  One way to discover the URL is\"...","commit_id":"3869c8ac90bebbfd11dc0a7aaac462bd8a92570b"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f8ddd57db7b736785231909e238a9a3e6226bb01","unresolved":false,"context_lines":[{"line_number":49,"context_line":"The Swift and Glance configuration items are specific to a given"},{"line_number":50,"context_line":"environment, so test configurations before deploying them in a"},{"line_number":51,"context_line":"production environment. Setting the Swift delay_auth_decision value to"},{"line_number":52,"context_line":"\u00270\u0027 (false) will require Keystone authentication to access the Swift"},{"line_number":53,"context_line":"containers."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Modifying Glance to not use Swift will mitigate the issue, but may"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da9df570_41e87510","line":52,"updated":"2014-09-23 17:43:28.000000000","message":"Capital F \u0027false\u0027?","commit_id":"3869c8ac90bebbfd11dc0a7aaac462bd8a92570b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":1,"context_line":"When using Swift as a back end for Glance, it may be possible for"},{"line_number":2,"context_line":"anonymous users to access public images."},{"line_number":3,"context_line":"---"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_64364be9","line":2,"updated":"2014-09-24 15:54:13.000000000","message":"I think we can trim down this title/subject and keep the majority of the details in the summary/discussion sections.  Maybe something like this:\n\n  Possible Glance image exposure via Swift","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"### Summary ###"},{"line_number":6,"context_line":"When Glance uses Swift as back end, and Swift uses delay_auth_decision"},{"line_number":7,"context_line":"setting, an unauthenticated user can access a public image by the URL."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Glance, Swift, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_84f24fd0","line":7,"updated":"2014-09-24 15:54:13.000000000","message":"I think we should add a little bit more info here (without duplicating the discussion section).  I usually like to have the summary section provide some basic background, such as:\n\n\"Glance is able to use Swift as a back end for storing virtual machine images.  When Swift is used as a back end for Glance, it is possible for unauthenticated users to access \"public\" virtual machine images directly from Swift, even though Glance restricts access to those images to authenticated users.\"\n\nYou can then leave all of the detail about \u0027delay_auth_decision\u0027 in the discussion section.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Glance, Swift, Havana, Icehouse"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Images in Glance that are labeled as public are accessible to any"},{"line_number":14,"context_line":"authenticated tenant, while public Swift containers are accessible"},{"line_number":15,"context_line":"regardless of authentication. When Glance is configured in multi-tenant"},{"line_number":16,"context_line":"mode to use Swift as a back end, and Swift has the delay_auth_decision"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_24036374","line":13,"updated":"2014-09-24 15:54:13.000000000","message":"I think this section could use some explanation of what \u0027delay_auth_decision\u0027 actually does.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Images in Glance that are labeled as public are accessible to any"},{"line_number":14,"context_line":"authenticated tenant, while public Swift containers are accessible"},{"line_number":15,"context_line":"regardless of authentication. When Glance is configured in multi-tenant"},{"line_number":16,"context_line":"mode to use Swift as a back end, and Swift has the delay_auth_decision"},{"line_number":17,"context_line":"value set the URL of the original Swift image can be inferred to allow"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_a4c4b35f","line":14,"updated":"2014-09-24 15:54:13.000000000","message":"I would say \"...accessible to all users, regardless of authentication.\"","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Images in Glance that are labeled as public are accessible to any"},{"line_number":14,"context_line":"authenticated tenant, while public Swift containers are accessible"},{"line_number":15,"context_line":"regardless of authentication. When Glance is configured in multi-tenant"},{"line_number":16,"context_line":"mode to use Swift as a back end, and Swift has the delay_auth_decision"},{"line_number":17,"context_line":"value set the URL of the original Swift image can be inferred to allow"},{"line_number":18,"context_line":"anonymous access to the image."},{"line_number":19,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_04ad7f9c","line":16,"updated":"2014-09-24 15:54:13.000000000","message":"Remove this comma.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":14,"context_line":"authenticated tenant, while public Swift containers are accessible"},{"line_number":15,"context_line":"regardless of authentication. When Glance is configured in multi-tenant"},{"line_number":16,"context_line":"mode to use Swift as a back end, and Swift has the delay_auth_decision"},{"line_number":17,"context_line":"value set the URL of the original Swift image can be inferred to allow"},{"line_number":18,"context_line":"anonymous access to the image."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"This can happen when Swift and Glance are configured in the following"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_049bbf67","line":17,"updated":"2014-09-24 15:54:13.000000000","message":"Add a comma after \"set\".","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":20,"context_line":"This can happen when Swift and Glance are configured in the following"},{"line_number":21,"context_line":"fashion:"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Swift proxy-server.conf"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"---- begin example proxy-server.conf snippet ----"},{"line_number":26,"context_line":"delay_auth_decision \u003d 1"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_84aecf83","line":23,"updated":"2014-09-24 15:54:13.000000000","message":"Take this line out and just add \"swift\" to the example header/footer below.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":26,"context_line":"delay_auth_decision \u003d 1"},{"line_number":27,"context_line":"---- end example proxy-server.conf snippet ----"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Glance glance-api.conf"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"---- begin example glance-api.conf snippet ----"},{"line_number":32,"context_line":"default_store \u003d swift"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_24b523cd","line":29,"updated":"2014-09-24 15:54:13.000000000","message":"Take this line out.  It\u0027s redundant.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":43,"context_line":"By default, Swift logging is enabled and can be used to audit Swift"},{"line_number":44,"context_line":"image requests to determine if an image is accessed, and if so which"},{"line_number":45,"context_line":"image is accessed. By default these log messages go to the"},{"line_number":46,"context_line":"\u0027/var/log/syslog\u0027 file."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The Swift and Glance configuration items are specific to a given"},{"line_number":49,"context_line":"environment, so test configurations before deploying them in a"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_44278712","line":46,"updated":"2014-09-24 15:54:13.000000000","message":"This paragraph describes a fact, but not a recommendation.  There should be a sentence saying something like:\n\n  \"It is recommended that you audit your Swift image requests to see if any images were exposed.\"\n\nIt also might be good to show an example of anonymous access of an image in Swift.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":45,"context_line":"image is accessed. By default these log messages go to the"},{"line_number":46,"context_line":"\u0027/var/log/syslog\u0027 file."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The Swift and Glance configuration items are specific to a given"},{"line_number":49,"context_line":"environment, so test configurations before deploying them in a"},{"line_number":50,"context_line":"production environment. Setting the Swift delay_auth_decision value to"},{"line_number":51,"context_line":"\u00270\u0027 (False) will require Keystone authentication to access the Swift"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_24bb6373","line":48,"updated":"2014-09-24 15:54:13.000000000","message":"This first sentence is a good summary/warning about any of the configuration changes we recommend.  I feel like it belongs at the end of this section after we\u0027ve outlined all of the possible mitigation options instead of here in this paragraph.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"56b5694ee5ef8f7fb7f49ca425e17112598a6c09","unresolved":false,"context_lines":[{"line_number":49,"context_line":"environment, so test configurations before deploying them in a"},{"line_number":50,"context_line":"production environment. Setting the Swift delay_auth_decision value to"},{"line_number":51,"context_line":"\u00270\u0027 (False) will require Keystone authentication to access the Swift"},{"line_number":52,"context_line":"containers."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Modifying Glance to not use Swift will mitigate the issue, but may"},{"line_number":55,"context_line":"introduce other issues depending on what is used. Setting the"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da9df570_24a44356","line":52,"updated":"2014-09-24 15:54:13.000000000","message":"So is there a downside with this recommendation?  If so, we should say what the tradeoff is.","commit_id":"a726b19d57f4af050298ef8042bf35ab4e384498"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"afa269992e962aeec058f262457a96100ace60d8","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Glance, Swift, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The \u0027delay_auth_decision\u0027 variable in Swift that modifies the ACL\u0027s to"},{"line_number":15,"context_line":"either require authentication via Keystone or allow unauthenticated"},{"line_number":16,"context_line":"access. When \u0027delay_auth_decision\u0027 is set to \u00271\u0027 the Swift ACL uses a"},{"line_number":17,"context_line":"wildcard (*) to accept all incoming responses."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"da9df570_18bdb6d8","line":14,"updated":"2014-09-25 23:08:11.000000000","message":"(nit) Remove the word \u0027that\u0027.","commit_id":"97604090b76055e84adcd0ce27a0fbb0ca8eb2c0"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"afa269992e962aeec058f262457a96100ace60d8","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"---- begin example Swift proxy-server.conf snippet ----"},{"line_number":27,"context_line":"delay_auth_decision \u003d 1"},{"line_number":28,"context_line":"---- end example proxy-server.conf snippet ----"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"---- begin example glance-api.conf snippet ----"},{"line_number":31,"context_line":"default_store \u003d swift"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"da9df570_38a99a91","line":28,"updated":"2014-09-25 23:08:11.000000000","message":"(nit) Add \u0027Swift\u0027 to the footer too.","commit_id":"97604090b76055e84adcd0ce27a0fbb0ca8eb2c0"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"afa269992e962aeec058f262457a96100ace60d8","unresolved":false,"context_lines":[{"line_number":39,"context_line":"can then be utilized anonymously to download the image."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Recommended Actions ###"},{"line_number":42,"context_line":"It is recommended that Swift image requests are audited to determine if"},{"line_number":43,"context_line":"an unauthorized image request was made. By default the log messages are"},{"line_number":44,"context_line":"contained in the \u0027/var/log/syslog\u0027 file."},{"line_number":45,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"da9df570_d81eceba","line":42,"updated":"2014-09-25 23:08:11.000000000","message":"A lead-in would be good here.  Something like:\n\n\"If your Swift and Glance services are configured in such a way that they are vulnerable to this issue, it is recommended...\"","commit_id":"97604090b76055e84adcd0ce27a0fbb0ca8eb2c0"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"afa269992e962aeec058f262457a96100ace60d8","unresolved":false,"context_lines":[{"line_number":41,"context_line":"### Recommended Actions ###"},{"line_number":42,"context_line":"It is recommended that Swift image requests are audited to determine if"},{"line_number":43,"context_line":"an unauthorized image request was made. By default the log messages are"},{"line_number":44,"context_line":"contained in the \u0027/var/log/syslog\u0027 file."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Setting the Swift \u0027delay_auth_decision\u0027 value to \u00270\u0027 (False) will"},{"line_number":47,"context_line":"require Keystone authentication to access the Swift containers, and is"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"da9df570_b8c90a5b","line":44,"updated":"2014-09-25 23:08:11.000000000","message":"This logfile is distro specific.  It would be better to say that Swift uses syslog for logging, and that one should look in the appropriate logging destination for their system.","commit_id":"97604090b76055e84adcd0ce27a0fbb0ca8eb2c0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5d17be7ecbb72345fc3bd68a7abfd5278c94a56f","unresolved":false,"context_lines":[{"line_number":16,"context_line":"When \u0027delay_auth_decision\u0027 is set to \u00271\u0027 the Swift ACL uses a wildcard"},{"line_number":17,"context_line":"(*) to accept all incoming responses."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"When Glance is configured in multi-tenant mode, this will allow all"},{"line_number":20,"context_line":"tenants as well as unauthenticated users to have access to the Swift"},{"line_number":21,"context_line":"\u0027public\u0027 images."},{"line_number":22,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":10,"id":"baa201ad_32712c78","line":19,"updated":"2014-10-10 12:42:34.000000000","message":"Does Glance have a \u0027mode\u0027 as such? \n\nPerhaps:\nWhen Glance is configured for multi-tenancy,","commit_id":"f62a5535011945d88dd53449c337d69d4f3b9e7d"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5d17be7ecbb72345fc3bd68a7abfd5278c94a56f","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"---- begin example Swift proxy-server.conf snippet ----"},{"line_number":27,"context_line":"delay_auth_decision \u003d 1"},{"line_number":28,"context_line":"---- end example Swift proxy-server.conf snippet ----"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"---- begin example glance-api.conf snippet ----"},{"line_number":31,"context_line":"default_store \u003d swift"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"baa201ad_d2d46049","line":28,"updated":"2014-10-10 12:42:34.000000000","message":"Please indent examples (2 spaces I believe is the standard)","commit_id":"f62a5535011945d88dd53449c337d69d4f3b9e7d"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5d17be7ecbb72345fc3bd68a7abfd5278c94a56f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"default_store \u003d swift"},{"line_number":32,"context_line":"swift_store_multi_tenant \u003d True"},{"line_number":33,"context_line":"swift_store_create_container_on_put \u003d True"},{"line_number":34,"context_line":"---- end example glance-api.conf snippet ----"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"One way to discover the URL is to take a snapshot of a public image. The"},{"line_number":37,"context_line":"URL for the snapshot combined with the owner ID of the public image will"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"baa201ad_f2c964ad","line":34,"updated":"2014-10-10 12:42:34.000000000","message":"Indent please","commit_id":"f62a5535011945d88dd53449c337d69d4f3b9e7d"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"e93b7098349dd270e65ed971e0f7928db979a637","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"One way to discover the URL is to take a snapshot of a public image. The"},{"line_number":37,"context_line":"URL for the snapshot combined with the owner ID of the public image will"},{"line_number":38,"context_line":"allow for the Swift URL for the public image to be inferred. This URL"},{"line_number":39,"context_line":"can then be utilized anonymously to download the image."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"baa201ad_15d6d2c5","line":38,"updated":"2014-10-10 13:27:21.000000000","message":"nit: .... for the Swift URL of the public image ...","commit_id":"f62a5535011945d88dd53449c337d69d4f3b9e7d"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5d17be7ecbb72345fc3bd68a7abfd5278c94a56f","unresolved":false,"context_lines":[{"line_number":48,"context_line":"require Keystone authentication to access the Swift containers, and is"},{"line_number":49,"context_line":"only recommended for environments using Keystone for authentication."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Modifying Glance to not use Swift will mitigate the issue, but may"},{"line_number":52,"context_line":"introduce other issues depending on what alternative is used."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The Swift and Glance configuration items are specific to a given"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"baa201ad_d264604b","line":51,"updated":"2014-10-10 12:42:34.000000000","message":"Is this a config option in Glance or are we talking about actually modifying glance?","commit_id":"f62a5535011945d88dd53449c337d69d4f3b9e7d"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"0e50ea0f112707c9fc9804736e240d7214acefa4","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Glance is able to use Swift as a back end for storing virtual machine"},{"line_number":6,"context_line":"images. When this is done, it is possible for unauthenticated users to"},{"line_number":7,"context_line":"access \"public\" virtual machine images directly from Swift, even though"},{"line_number":8,"context_line":"Glance restricts access to those images to authenticated users."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":12,"id":"baa201ad_12967a3f","line":6,"updated":"2014-10-15 09:38:44.000000000","message":"Glance can be configured to use swift in two different ways:\n\n 1) single-tenant mode (default)\n 2) multi-tenant mode\n\nThis security note seems to suggest that both single-tenant and multi-tenant mode are affected.\n\nI may be wrong, but I don\u0027t think single-tenant mode is affected.\n\nIf so, it\u0027s important to make the distinction.","commit_id":"ba7db45b145daf8144f02fded69af0bba317e232"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"75646a40160808106c6a687d73d8411b4f5362f3","unresolved":false,"context_lines":[{"line_number":49,"context_line":"require Keystone authentication to access the Swift containers, and is"},{"line_number":50,"context_line":"only recommended for environments using Keystone for authentication."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Modifying the Glance configuration to not use Swift will mitigate the"},{"line_number":53,"context_line":"issue, but may introduce other issues depending on what alternative is"},{"line_number":54,"context_line":"used."},{"line_number":55,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":13,"id":"baa201ad_13439c13","line":52,"updated":"2014-10-17 09:47:46.000000000","message":"nit: \u0027to not use Swift\u0027 -\u003e \u0027to not use Swift in multi-tenant mode\u0027?","commit_id":"5006569ada4003ca615d6d29be3233e8ea6eec1e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"b968b6245ae651ac5d63e2dd75362fe470167517","unresolved":false,"context_lines":[{"line_number":49,"context_line":"require Keystone authentication to access the Swift containers, and is"},{"line_number":50,"context_line":"only recommended for environments using Keystone for authentication."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Modifying the Glance configuration to not use Swift will mitigate the"},{"line_number":53,"context_line":"issue, but may introduce other issues depending on what alternative is"},{"line_number":54,"context_line":"used."},{"line_number":55,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":13,"id":"baa201ad_54ffc001","line":52,"in_reply_to":"baa201ad_13439c13","updated":"2014-10-17 18:25:38.000000000","message":"Stuart, this was more to provide the option of something like Ceph, without delving into its technical details. Should the Swift ACLs and permissions be reviewed here as well?","commit_id":"5006569ada4003ca615d6d29be3233e8ea6eec1e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1ef82409211e0c165eac67b7694c1c7944a66595","unresolved":false,"context_lines":[{"line_number":49,"context_line":"require Keystone authentication to access the Swift containers, and is"},{"line_number":50,"context_line":"only recommended for environments using Keystone for authentication."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Modifying the Glance configuration to not use Swift will mitigate the"},{"line_number":53,"context_line":"issue, but may introduce other issues depending on what alternative is"},{"line_number":54,"context_line":"used."},{"line_number":55,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":13,"id":"9aa7fdbe_6b766540","line":52,"in_reply_to":"baa201ad_54ffc001","updated":"2014-10-20 15:56:24.000000000","message":"I was just suggesting a wording change since the current wording here seems to suggest not using swift at all (where moving to use swift in single tenant mode would eliminate this issue just as well as moving to ceph/something else).","commit_id":"5006569ada4003ca615d6d29be3233e8ea6eec1e"}]}