Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DAOS-12100 control: Update admin cert key required perms #11271

Merged
merged 3 commits into from
Jan 24, 2023
Merged

DAOS-12100 control: Update admin cert key required perms #11271

merged 3 commits into from
Jan 24, 2023

Conversation

kjacque
Copy link
Contributor

@kjacque kjacque commented Jan 20, 2023 •
edited
Loading

The admin certificate key may be owned by an admin group, rather than an individual user.

In practice most private keys should be owner-read-only (0400), but the admin cert may also be readable by the admin group (0440).

Required-githooks: true
Features: control

Signed-off-by: Kris Jacque [email protected]

Before requesting gatekeeper:

  • Two review approvals and any prior change requests have been resolved.
  • Testing is complete and all tests passed or there is a reason documented in the PR why it should be force landed and forced-landing tag is set.
  • Features: (or Test-tag*) commit pragma was used or there is a reason documented that there are no appropriate tags for this PR.
  • Commit messages follows the guidelines outlined here.
  • Any tests skipped by the ticket being addressed have been run and passed in the PR.

Gatekeeper:

  • You are the appropriate gatekeeper to be landing the patch.
  • The PR has 2 reviews by people familiar with the code, including appropriate watchers.
  • Githooks were used. If not, request that user install them and check copyright dates.
  • Checkpatch issues are resolved. Pay particular attention to ones that will show up on future PRs.
  • All builds have passed. Check non-required builds for any new compiler warnings.
  • Sufficient testing is done. Check feature pragmas and test tags and that tests skipped for the ticket are run and now pass with the changes.
  • If applicable, the PR has addressed any potential version compatibility issues.
  • Check the target branch. If it is master branch, should the PR go to a feature branch? If it is a release branch, does it have merge approval in the JIRA ticket.
  • Extra checks if forced landing is requested
    • Review comments are sufficiently resolved, particularly by prior reviewers that requested changes.
    • No new NLT or valgrind warnings. Check the classic view.
    • Quick-build or Quick-functional is not used.
  • Fix the commit message upon landing. Check the standard here. Edit it to create a single commit. If necessary, ask submitter for a new summary.

@kjacque
DAOS-12100 control: Update admin cert key required perms
822d8d4 
The admin certificate key may be owned by an admin group, rather
than an individual user.

In practice most private keys should be owner-read-only (0400), but
the admin cert may also be readable by the admin group (0440).

Required-githooks: true
Features: control

Signed-off-by: Kris Jacque <[email protected]>
@kjacque kjacque self-assigned this Jan 20, 2023
@kjacque kjacque marked this pull request as ready for review January 20, 2023 18:17
@kjacque kjacque requested a review from a team as a code owner January 20, 2023 18:17
@kjacque kjacque requested review from mjmac and removed request for a team January 20, 2023 18:17
@kjacque kjacque added the release-2.4 PR is eventually targeted for 2.4 label Jan 20, 2023
daosbuild1
daosbuild1 reviewed Jan 20, 2023
View reviewed changes
Copy link
Collaborator

@daosbuild1 daosbuild1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. No errors found by checkpatch.

@kjacque kjacque requested a review from tanabarr January 20, 2023 18:18
mjmac
mjmac previously approved these changes Jan 20, 2023
View reviewed changes
@github-actions
Copy link

Bug-tracker data:
Ticket title is 'admin.key should allow chmod 0440'
Status is 'In Review'
Labels: 'required_24tb2,triaged'
Job should run at elevated priority (3)
https://daosio.atlassian.net/browse/DAOS-12100

@github-actions github-actions bot added the priority Ticket has high priority (automatically managed) label Jan 20, 2023
daosbuild1
daosbuild1 reviewed Jan 20, 2023
View reviewed changes
Copy link
Collaborator

@daosbuild1 daosbuild1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. No errors found by checkpatch.

@kjacque kjacque requested a review from knard38 January 20, 2023 19:09
@daosbuild1
Copy link
Collaborator

Test stage Functional Hardware Medium completed with status UNSTABLE. https://build.hpdd.intel.com/job/daos-stack/job/daos//view/change-requests/job/PR-11271/3/testReport/(root)/

@daosbuild1
Copy link
Collaborator

Test stage Functional Hardware Medium UCX Provider completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-11271/3/execution/node/1173/log

tanabarr
tanabarr previously approved these changes Jan 22, 2023
View reviewed changes
knard38
knard38 reviewed Jan 23, 2023
View reviewed changes
src/control/security/pem.go Outdated
MaxUserOnlyKeyPerm os.FileMode = 0400
MaxGroupKeyPerm os.FileMode = 0440
MaxCertPerm os.FileMode = 0664
MaxDirPerm os.FileMode = 0700
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably a stupid question (not really familiar with this portion of the code).
Is the key file stored in the directory with MaxDirPerm ?
If yes, even with MaxGroupKeyPerm set, the user from the authorized group will not be able to access the key cert ?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, I think MaxDirPerm should be 0750 or "group" cannot get to the admin.key

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. Fixing

Michael-Hennecke
Michael-Hennecke requested changes Jan 23, 2023
View reviewed changes
Copy link
Collaborator

@Michael-Hennecke Michael-Hennecke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see MaxDirPerm comment...

@kjacque
Merge branch 'master' into kjacque/admin-key-perms
86f81d1
@kjacque
Fix max directory permissions
007b040 
Features: control,security

Required-githooks: true

Signed-off-by: Kris Jacque <[email protected]>
@kjacque kjacque dismissed stale reviews from tanabarr and mjmac via 007b040 January 23, 2023 18:03
daosbuild1
daosbuild1 reviewed Jan 23, 2023
View reviewed changes
Copy link
Collaborator

@daosbuild1 daosbuild1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. No errors found by checkpatch.

knard38
knard38 approved these changes Jan 23, 2023
View reviewed changes
Copy link
Contributor

@knard38 knard38 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@daosbuild1
Copy link
Collaborator

Test stage Functional Hardware Medium completed with status FAILURE. https://build.hpdd.intel.com//job/daos-stack/job/daos/view/change-requests/job/PR-11271/4/execution/node/1220/log

@mjmac
Copy link
Contributor

mjmac commented Jan 24, 2023

Test failures appear to be due to engine segfaults in racer/rebuild tests, seems unlikely that they are related to this patch.

@sylviachanoiyee sylviachanoiyee merged commit 1a16e69 into master Jan 24, 2023
@sylviachanoiyee sylviachanoiyee deleted the kjacque/admin-key-perms branch January 24, 2023 14:58
kjacque added a commit that referenced this pull request Jan 24, 2023
@kjacque
DAOS-12100 control: Update admin cert key required perms (#11271)
7bfe0ef 
The admin certificate key may be owned by an admin group, rather
than an individual user.

In practice most private keys should be owner-read-only (0400), but
the admin cert may also be readable by the admin group (0440).

Features: control,security

Signed-off-by: Kris Jacque <[email protected]>
mjmac pushed a commit that referenced this pull request Jan 26, 2023
@kjacque
DAOS-12100 control: Update admin cert key required perms (#11271) (#1…
05f2087 
…1294)

The admin certificate key may be owned by an admin group, rather
than an individual user.

In practice most private keys should be owner-read-only (0400), but
the admin cert may also be readable by the admin group (0440).

Signed-off-by: Kris Jacque <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@daosbuild1 daosbuild1 daosbuild1 left review comments

@knard38 knard38 knard38 approved these changes

@tanabarr tanabarr tanabarr approved these changes

@mjmac mjmac mjmac approved these changes

@Michael-Hennecke Michael-Hennecke Awaiting requested review from Michael-Hennecke

Assignees

@kjacque kjacque

Labels
priority Ticket has high priority (automatically managed) release-2.4 PR is eventually targeted for 2.4
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@kjacque @daosbuild1 @mjmac @tanabarr @Michael-Hennecke @knard38 @sylviachanoiyee