LXC template security

[Major Hayden]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hey folks,

I noticed that a few of us are involved in the LXC template security issue that cropped up
in a few different tickets:

  https://bugzilla.redhat.com/show_bug.cgi?id=1132001
  https://bugzilla.redhat.com/show_bug.cgi?id=1132002
  https://bugzilla.redhat.com/show_bug.cgi?id=1132003
  https://bugzilla.redhat.com/show_bug.cgi?id=1132004

Unfortunately, I grabbed 1132004 and overlooked the others.  If y'all are already
working through this one with upstream, I'll gladly hand it off. ;)

- --
Major Hayden
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQIcBAEBCAAGBQJVgBvHAAoJEHNwUeDBAR+xGG0P/3cZBg1gi3yWtVP6jGoIR45k
> 9JSKz1HGe6MYGHQlb2Mr6jpQKtTHcQUg346hhlzux4l9qKbzKg0O22OMD/fmE67N
> +ILBtRbbHw+/yaS2wN21eBTXBkE/+UZtml3pprLhv40g7xZT72Fo5IhfuwiNfy0Y
> zD4nVrbeqxBc2jNRD04xB+vCc0RA5rxTTrvoZOlg+IndnRCoJYAypkSP4wxOpUZU
> RlCvs+Wq6uIGBPhAdLQQ3vaJ/7V5wA+zK6/shXrSvKpnGJ/YPVfZ2eMBy/0R7M9v
> bb5Xz8E6TmGCueN3nKLx0Jn2favlf26DKQBxg2EF0zlUM4UGKTnS58ZqxDc2C8D1
> 8OGo01+bjVddaes8ielGXUhl54Wo1l8T7YwzWe2tpTxi0zKNa48PY6/Xigq66U5q
> 8JCK8IOAEdhtNAHYHcmM6xjFIe0g4zmM09E2YcakJb05y9+97JHt8YoYEhkE+c8S
> j+WInqCKUNEEtdGmgFeIPncrVxPRObZ8RKJONA4zeWOW/TN/zPiqPIK2uvOLE5E5
> WingxuvzvbglZMe+2xah9EutYyJWZ07NEjtJTVu9eLNGQ7C6fQ1Y6uQY61rJlqdg
> sFqRXMFrP4oxeejwD5BduB+dWYbDVzxmaTmdrQ1jXS2sjNlnYxPZMq9/EE/gbKgn
> +D9di2533T0bVd2b8Wgy
> =waVt
> -----END PGP SIGNATURE-----

[David Cafaro]

On 06/16/2015 08:51 AM, Major Hayden wrote:
>  Hey folks,
>
>  I noticed that a few of us are involved in the LXC template security 
issue that
cropped up in a few different tickets:
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132001
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132002
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132003
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132004
>
>  Unfortunately, I grabbed 1132004 and overlooked the others.  If y'all 
are
already working through this one with upstream, I'll gladly hand it
off. ;)

Looks like just you and PJP (1132002) have owned/worked them with
1132001 and 1132003 unowned.

Cheers,
David

[Major Hayden]

On 06/16/2015 07:57 AM, David Cafaro wrote:
>  Looks like just you and PJP (1132002) have owned/worked them with
> 1132001 and 1132003 unowned. 
PJP -- I'll gladly yield on this one so you can continue working it or we can work
together.

--
Major Hayden

[P J P]

   Hello Major,

>  On Tuesday, 16 June 2015 6:38 PM, Major Hayden wrote:
>  I noticed that a few of us are involved in the LXC template security issue that
>  cropped up in a few different tickets:
>
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132001
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132002
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132003
>    https://bugzilla.redhat.com/show_bug.cgi?id=1132004
>
>  Unfortunately, I grabbed 1132004 and overlooked the others.  If y'all are
>  already working through this one with upstream, I'll gladly hand it off. ;) 


  I've been following up on BZ#1132002 with the Fedora maintainer, he was in touch
with the upstream. But no reply since my last ping; I have set needinfo on it today,
let's hope we hear some update. I'll follow-up with him on it.

For other bugs listed above, feel free to go ahead with them. Let me know if I could help
in any way.

Thank you.

---
Regards
   -P J P
http://feedmug.com

[Major Hayden]

On 06/16/2015 10:13 AM, P J P wrote:
>    I've been following up on BZ#1132002 with the Fedora
> maintainer, he was in touch with the upstream. But no reply since my last ping; I have set
> needinfo on it today, let's hope we hear some update. I'll follow-up with him on
> it.
>  
>  For other bugs listed above, feel free to go ahead with them. Let me know if I could help
> in any way. 
It looks like Serge is welcoming of some updates:

  https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-June/011888.html

> From what I gather, the same upstream fixes would solve all of the
> tickets there (1132001 through 1132004) since the LXC templates are just additional files
> packaged along with all LXC versions.  The big question would be *how* to fix the root
> password problems.  After digging, I've seen the following suggested: 
  1) Port the randomized password functionality from Fedora/CentOS templates into the
others
  2) Empty the root password and disallow logins with empty passwords

#2 seems a little annoying for the user because they can't even get into their
container unless they use lxc-attach.  #1 might work for the other templates since
it's already working well for the Fedora/CentOS templates.  Either one will require
some testing with each distribution.

Any thoughts on which way we ought to go?

--
Major Hayden

[P J P]

  Hello Major,

>  On Wednesday, 17 June 2015 7:32 AM, Major Hayden wrote:
>  From what I gather, the same upstream fixes would solve all of the tickets there
>  (1132001 through 1132004) since the LXC templates are just additional files
>  packaged along with all LXC versions. 
  Yes, true.

>  The big question would be *how* to fix the root password problems.
>  After digging, I've seen the following suggested:
>
>  1) Port the randomized password functionality from Fedora/CentOS templates
>  into the others
>  2) Empty the root password and disallow logins with empty passwords
>
>  #2 seems a little annoying for the user because they can't even get into
>  their container unless they use lxc-attach. #1 might work for the other
>  templates since it's already working well for the Fedora/CentOS templates.
>  Either one will require some testing with each distribution.
>
>  Any thoughts on which way we ought to go? 
  Though shipping LXC images with locked root account and explicit instructions to unlock
it is a better solution IMO, I know many users would not like it, because it might break
their work-flow.


Considering that, I think it's okay to go ahead with the random password approach, as
is implemented by Fedora/CentOS templates. That way it'll be consistent user
experience across different templates.


---
Regards
   -P J P
http://feedmug.com

[Major Hayden]

On 06/17/2015 02:24 AM, P J P wrote:
>  Considering that, I think it's okay to go ahead with the random
> password approach, as is implemented by Fedora/CentOS templates. That way it'll be
> consistent user experience across different templates. 
No objections here.  I might try working through the Debian template to see if I can
implement the randomized password functionality there.  Hopefully that will be easy to
carry over to Ubuntu.

--
Major Hayden