1:47 p.m.
#6170: respin f21 Docker Base image for security update
-----------------------------+------------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Keywords: | Blocked By:
Blocking: |
-----------------------------+------------------------
See https://bugzilla.redhat.com/show_bug.cgi?id=1175997
Specifically we need https://git.fedorahosted.org/cgit/spin-
kickstarts.git/commit/?h=f21
(Also, make sure the equivalent commit ends up in F22 Final)
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
3:13 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by ausil):
The request should come from the security response team
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:1>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
3:29 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by pfrields):
According to the bug, SRT agrees this issue needs to be fixed (q.v.
https://bugzilla.redhat.com/show_bug.cgi?id=1175997#c5). I don't
understand why the reporter of the ticket matters, if the change is
necessary to fix an ack'd security issue. That just costs time.
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:2>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
3:58 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by sparks):
Replying to [ticket:6170 walters]:
See https://bugzilla.redhat.com/show_bug.cgi?id=1175997
Specifically we need https://git.fedorahosted.org/cgit/spin-
kickstarts.git/commit/?h=f21
(Also, make sure the equivalent commit ends up in F22 Final)
Yes, this problem exists and should be remedied.
--Eric "Sparks" Red Hat SRT
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:3>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
7:32 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by ausil):
Just that it seems like Security Respone would be the ones coming and
saying hey we need this bug fixed which means we need a new compose of
foo. rather than getting requests for such things from all over the place.
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:4>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
7:46 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by ausil):
http://dl.fedoraproject.org/pub/alt/stage/21-20150506/
there is new cloud images and a f21 docker base image there. F22 will be
fixed with the nightly compose and next compose, and the rawhide images
will get fixed with the next nightly compose. once they are verified I can
move them to a live location.
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:5>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
1:49 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by walters):
Was any action taken on this for F21 to upload it to the Docker Hub?
We don't at the moment have a changelog on
https://registry.hub.docker.com/_/fedora/
How this sausage gets made is pretty opaque to me at the moment. Is
https://github.com/fedora-cloud/docker-brew-fedora
still involved?
The kickstart there is clearly vulnerable...but on the other hand,
from what I can tell "docker pull fedora:21" on the Hub *isn't*
vulnerable.
Did it get fixed some other way?
Did the content from here get uploaded? Who did that if so?
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:6>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
2:11 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by walters):
The tarball from Fedora-Docker-Base-21-20150506.x86_64 looks good to me.
{{{
# curl http://dl.fedoraproject.org/pub/alt/stage/21-20150506/Docker/x86_64
/Fedora-Docker-Base-21-20150506.x86_64.tar.xz | docker load
# docker run --rm -ti Fedora-Docker-Base-21-20150506.x86_64 grep root
/etc/passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
#
}}}
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:7>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
10:10 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Changes (by ausil):
* cc: lsm5 (added)
Comment:
releng has no ability to upload anything to the docker hub, you will need
to ask those responsible. I have no idea what https://github.com/fedora-
cloud/docker-brew-fedora is. I also have no idea if the update was pushed
there, I have cc'd lsm5 who has been uploading to the docker registry.
sadly docker does not provide a way to automatically upload the base
images, no client or api.
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:8>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
10:38 a.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by walters):
I found out some more information on this.
https://github.com/docker-library/official-images/issues/527
https://github.com/docker-library/official-images/pull/497
are some useful threads. The latter in particular starts to describe how
we can improve the Fedora -> Hub flow.
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:9>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
11:41 a.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by walters):
So...there may not be an emergency here, although I want to understand
*why* that is.
{{{
https://dl.fedoraproject.org/pub/fedora/linux/releases/21/Docker/x86_64
/Fedora-Docker-Base-20141203-21.x86_64.tar.gz
curl
https://dl.fedoraproject.org/pub/fedora/linux/releases/21/Docker/x86_64
/Fedora-Docker-Base-20141203-21.x86_64.tar.gz | docker load
docker run --rm -ti Fedora-Docker-Base-20141203-21.x86_64 grep root
/etc/passwd
root:x:0:0:root:/root:/bin/bash
}}}
So that image is *not* vulnerable. Yet if you go to the f21 spin-
kickstarts branch:
https://git.fedorahosted.org/cgit/spin-kickstarts.git/log/?h=f21
The click on the parent of my security fix, then tree and look at the
kickstart, I see:
https://git.fedorahosted.org/cgit/spin-kickstarts.git/tree/fedora-docker-
base.ks?h=f21&id=843b6a344e30c2cc4b4c5261849c161c725f5965#n9
And there's nothing locking it.
Dennis, is there a way to know which Koji task (that would have a link to
the kickstart) was used to generate that image? I'm not seeing a way to
query this in the web UI at least.
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:10>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
3:12 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by walters):
So I'm a moron and have been looking at /etc/passwd when obviously I meant
/etc/shadow. Let's try this again!
Current F21 respun Docker image: FIXED!
# docker run --rm -ti Fedora-Docker-Base-21-20150506.x86_64 grep root
/etc/shadow
root:locked::0:99999:7:::
# Old F21 Docker image: VULNERNABLE
# docker run --rm -ti Fedora-Docker-Base-20141203-21.x86_64 grep root
/etc/shadow
root:$6$DoHwMNPipK/gAVGn$qseLnsvYNGkBBQQDoKfuYWdHR/b6jLMjDwbT32ad97.EvspmbtfqhyQezyYFrqN0Bk/iNTey1upR5i816bGMR1::0:99999:7:::
So we do need to get this new base image published.
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:11>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
12:30 p.m.
#6170: respin f21 Docker Base image for security update
------------------------------+-----------------------
Reporter: walters | Owner: rel-eng@…
Type: task | Status: new
Milestone: Fedora 22 Final | Component: other
Resolution: | Keywords:
Blocked By: | Blocking:
------------------------------+-----------------------
Comment (by walters):
https://github.com/docker-library/official-images/pull/736
--
Ticket URL: <https://fedorahosted.org/rel-eng/ticket/6170#comment:12>
Fedora Release Engineering <http://fedorahosted.org/rel-eng>
Release Engineering for the Fedora Project
3291
days inactive
3300
days old
rel-eng@lists.fedoraproject.org
12 comments
1 participants
participants (1)
-
Fedora Release Engineering