Bug #43607
closed
- Priority changed from High to Immediate
- Tags set to security
- Severity changed from 2 - major to 1 - critical
- Status changed from New to In Progress
- Pull request ID set to 32652
Unfortunately the referenced rook issue does not provide any details about the problem. In regular deployments, the Mgr process does not run with root privileges, so the dashboard module should not be able to access any sensitive files. Is this different from how Ceph is deployed by Rook?
- Description updated (diff)
- Affected Versions v14.2.5, v14.2.6, v15.0.0 added
- Private changed from Yes to No
Lenz Grimmer wrote:
Unfortunately the referenced rook issue does not provide any details about the problem. In regular deployments, the Mgr process does not run with root privileges, so the dashboard module should not be able to access any sensitive files. Is this different from how Ceph is deployed by Rook?
As mentioned by e-mail, anything under ceph:ceph ownership could be exposed, and depending on the deployment setup that might mean a lot:
- Ceph keyrings
- Ceph logs (ceph-mgr exposes sensitive information as described in https://tracker.ceph.com/issues/37503, including ceph-dashboard admin password, RGW secrets, etc).
- Ceph daemon data (/var/lib/ceph)
- procfs info from Ceph processes
- Description updated (diff)
- Private changed from No to Yes
- Status changed from In Progress to Pending Backport
- Copied to Backport #43725: nautilus: mgr/dashboard: fix improper URL checking added
- Copied to deleted (Backport #43725: nautilus: mgr/dashboard: fix improper URL checking)
- Copied to Backport #43725: nautilus: mgr/dashboard: fix improper URL checking added
- Translation missing: en.field_tag_list set to security
- Status changed from Pending Backport to Resolved
- Private changed from Yes to No
- Tags deleted (
security)
- Parent task set to #47765
- Project changed from mgr to Dashboard
- Category changed from 146 to General - Back-end
Also available in: Atom
PDF