)]}'
{"elements/overcloud-secure-block-device/environment.d/10-overcloud-secure-block-device":[{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"9217d2f18f820766ab4b1c05b8b05837da2fafd3","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    mount_point: /var"},{"line_number":67,"context_line":"    fstab:"},{"line_number":68,"context_line":"        options: \"rw,relatime\""},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- mkfs:"},{"line_number":71,"context_line":"    name: fs_log"},{"line_number":72,"context_line":"    base: lv_log"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ffe62b97_059ebe62","line":69,"updated":"2017-03-24 09:33:13.000000000","message":"Also need an entry for /var/tmp with nosuid,nodev,noexec\n\nSee CIS benchmark, section 1.1.7: file:///home/luke/project-files/tripleo-security-hardening/CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v2.1.0.pdf","commit_id":"512f41fa2479db3a2661f1a8a9fb45cad37293ef"}],"elements/overcloud-secure/README.md":[{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"54ac28eff24c922aef267bf069f713972a9ad29e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":12,"id":"df140735_a6770a3b","updated":"2017-05-30 14:32:24.000000000","message":"Please use RST instead of MD for the readme.  We don\u0027t enforce it in this repo, but it\u0027s the standard for DIB elements (see also the mddocs dib-lint check which would fail on this file: https://github.com/openstack/diskimage-builder/blob/master/bin/dib-lint#L232 )","commit_id":"6cf3274afe2f6c474a0369899f2033f5420d011f"}],"elements/overcloud-secure/block-device-config.yaml":[{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"a0a85dbbc12f96a25502086947298812c539dba8","unresolved":false,"context_lines":[{"line_number":24,"context_line":"                fstab:"},{"line_number":25,"context_line":"                    options: \"rw,nosuid,nodev,noexec,relatime\""},{"line_number":26,"context_line":"      - name: var"},{"line_number":27,"context_line":"        size: 5G"},{"line_number":28,"context_line":"        mkfs:"},{"line_number":29,"context_line":"            type: xfs"},{"line_number":30,"context_line":"            mount:"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"ff0f0b1f_84c1c7e7","line":27,"updated":"2017-05-25 20:11:36.000000000","message":"Isn\u0027t /var where all of the instance files go?  This wouldn\u0027t be able to handle a single instance disk.\n\nOr is there another definition somewhere that creates separate partitions for service-specific directories?","commit_id":"e9ac68944ceb3f5d0ce6af98c6f4d5ea56adf366"},{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"a0a85dbbc12f96a25502086947298812c539dba8","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                fstab:"},{"line_number":33,"context_line":"                    options: \"rw,relatime\""},{"line_number":34,"context_line":"      - name: log"},{"line_number":35,"context_line":"        size: 3G"},{"line_number":36,"context_line":"        mkfs:"},{"line_number":37,"context_line":"            type: xfs"},{"line_number":38,"context_line":"            mount:"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"ff0f0b1f_84f30774","line":35,"updated":"2017-05-25 20:11:36.000000000","message":"This won\u0027t be enough for any long-lived and/or highly used cloud.  In rh1 our /var/log is 11.2 GB right now, and that\u0027s just a moderately sized cloud (~30 computes), though admittedly pretty high utilization.","commit_id":"e9ac68944ceb3f5d0ce6af98c6f4d5ea56adf366"}],"elements/overcloud-secure/package-installs.yaml":[{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"d557d7e9995c0027fc708c4938db0eec516a00d4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"kexec-tools:"},{"line_number":2,"context_line":"  uninstall: True"},{"line_number":3,"context_line":"telnet:"},{"line_number":4,"context_line":"  uninstall: True"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"bff0334d_679976c2","line":4,"updated":"2017-04-11 05:34:21.000000000","message":"Why do we need these in tripleo-common? Wouldn\u0027t it be better to just uninstall them entirely?","commit_id":"f9d329895674d1c5905f42e47b3deb8b0ff1dfd0"},{"author":{"_account_id":6133,"name":"yolanda.robla","email":"yroblamo@redhat.com","username":"yolanda.robla"},"change_message_id":"7c13cfa287d409f115272c0d083bcda26973ff2e","unresolved":false,"context_lines":[{"line_number":1,"context_line":"kexec-tools:"},{"line_number":2,"context_line":"  uninstall: True"},{"line_number":3,"context_line":"telnet:"},{"line_number":4,"context_line":"  uninstall: True"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ff0f0b1f_8a9bc5c7","line":4,"in_reply_to":"bff0334d_679976c2","updated":"2017-05-19 15:12:22.000000000","message":"Hi we don\u0027t install them specifically, but they come by default on the rhel7 images that we generate. And we need to get rid of those packages in the hardened one. Would you prefer that the uninstall is applied globally to all rhel distro?","commit_id":"f9d329895674d1c5905f42e47b3deb8b0ff1dfd0"}]}