Package: magnum / 3.1.1-5

Metadata

Package Version Patches format
magnum 3.1.1-5 3.0 (quilt)

Patch series

view the series file
Patch File delta Description
install missing files.patch | (download)

MANIFEST.in | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 installing missing alembic migration files
 As always, PBR misses the Alembic stuff.
allow sqla 1.1.patch | (download)

requirements.txt | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 allow sqlalchemy >= 1.1
CVE 2016 7404.patch | (download)

devstack/lib/magnum | 1 1 + 0 - 0 !
etc/magnum/policy.json | 58 30 + 28 - 0 !
magnum/common/keystone.py | 12 12 + 0 - 0 !
magnum/common/policy.py | 12 12 + 0 - 0 !
magnum/conductor/handlers/common/trust_manager.py | 13 10 + 3 - 0 !
magnum/db/sqlalchemy/api.py | 17 16 + 1 - 0 !
magnum/drivers/common/template_def.py | 16 15 + 1 - 0 !
magnum/drivers/common/templates/kubernetes/fragments/make-cert-client.sh | 5 0 + 5 - 0 !
magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh | 5 0 + 5 - 0 !
magnum/drivers/common/templates/kubernetes/fragments/write-heat-params-master.yaml | 2 1 + 1 - 0 !
magnum/drivers/common/templates/kubernetes/fragments/write-heat-params.yaml | 2 1 + 1 - 0 !
magnum/drivers/k8s_coreos_v1/templates/fragments/make-cert-client.yaml | 5 0 + 5 - 0 !
magnum/drivers/k8s_coreos_v1/templates/fragments/make-cert.yaml | 5 0 + 5 - 0 !
magnum/drivers/k8s_coreos_v1/templates/fragments/write-heat-params-master.yaml | 2 1 + 1 - 0 !
magnum/drivers/k8s_coreos_v1/templates/fragments/write-heat-params.yaml | 2 1 + 1 - 0 !
magnum/drivers/mesos_ubuntu_v1/templates/fragments/write-heat-params.yaml | 2 1 + 1 - 0 !
magnum/drivers/swarm_fedora_atomic_v1/templates/fragments/make-cert.py | 6 0 + 6 - 0 !
magnum/drivers/swarm_fedora_atomic_v1/templates/fragments/write-heat-params-master.yaml | 2 1 + 1 - 0 !
magnum/drivers/swarm_fedora_atomic_v1/templates/fragments/write-heat-params-node.yaml | 2 1 + 1 - 0 !
magnum/tests/base.py | 27 27 + 0 - 0 !
magnum/tests/unit/common/test_keystone.py | 15 15 + 0 - 0 !
magnum/tests/unit/conductor/handlers/common/test_trust_manager.py | 3 2 + 1 - 0 !
magnum/tests/unit/conductor/handlers/test_cluster_conductor.py | 5 5 + 0 - 0 !
magnum/tests/unit/conductor/handlers/test_k8s_cluster_conductor.py | 16 10 + 6 - 0 !
magnum/tests/unit/conductor/handlers/test_mesos_cluster_conductor.py | 9 5 + 4 - 0 !
magnum/tests/unit/conductor/handlers/test_swarm_cluster_conductor.py | 8 7 + 1 - 0 !
26 files changed, 174 insertions(+), 78 deletions(-)

 [patch] fix cve-2016-7404

This commit addresses multiple potential vulnerabilities in
Magnum. It makes the following changes:

* Permissions for /etc/sysconfig/heat-params inside Magnum
  created instances are tightened to 0600 (used to be 0755).
* Certificate retrieval is modified to work without the need
  for a Keystone trust.
* The cluster's Keystone trust id is only passed into
  instances for clusters where that is actually needed. This
  prevents the trustee user from consuming the trust in cases
  where it is not needed.
* The configuration setting trust/cluster_user_trust (False by
  default) is introduced. It needs to be explicitely enabled
  by the cloud operator to allow clusters that need the
  trust_id to be passed into instances to work. Without this
  setting, attempts to create such clusters will fail.

Please note, that none of these changes apply to existing
clusters. They will have to be deleted and rebuilt to benefit
from these changes.

(cherry picked from commit e93d82e8b3bc19211efd54edc17aebdca50670c1)

Changes for backport:

* Moved cluster_user_trust setting to magnum/common/keystone.py
* Resolved merge conflicts.
* Fixed unit tests with configuration overrides.