Saturday, 2015-07-04

*** mandre has joined #kolla00:22
*** bradjones has quit IRC00:28
*** ogelbukh1 has quit IRC00:34
*** erkules_ has joined #kolla01:28
*** erkules has quit IRC01:31
*** bmace has quit IRC02:16
*** dims_ has joined #kolla02:17
*** bmace has joined #kolla02:28
*** ogelbukh1 has joined #kolla02:35
SamYaplesdake i is here02:43
sdakesamyaple did you see post on ml02:52
sdakegreg seems to be ok with the for approach02:52
sdakefork02:52
SamYapleyea02:53
SamYaplebut im not quite shure what to make of it all02:53
SamYapleso fork of modules only in seperate repo, and we just pip install them/02:54
sdakefork and maintain only the stuf fwe need and make it pip installabble02:54
sdakeyup02:54
SamYapledid legal get looped in on that?02:54
SamYaplei had recommended that originally and yo usaid no02:54
sdakei dont recall you recommending that02:55
sdakeif you did I guess I was drugged02:55
SamYaplei said forked in seperate repo that we could pull in02:55
SamYaplei did not use the word 'pip'02:55
sdakei see02:56
sdakepull in to me = mege into repo02:56
SamYaple"seperate repo"02:56
SamYaplebut its cool, as long as legal is ok since that was teh reason you rejected it02:57
sdakenah the reason I rejected it is I thought you were goin to pull them into our repo02:58
sdakeIANAL02:58
sdakebut if its a separate gplv3 repo02:58
sdakeit doesn't affect us at all02:58
SamYaplethats what i said, but we will say the drugs prevented decent communication02:58
sdakepossible i was feeling pretty miserable when we originally discussed it a week ago02:59
sdakeso there is a repo there in my github02:59
sdakego crazy :)02:59
SamYaplei saw02:59
SamYaplemy question is how will these be installed? To where. These aren't regular modules that python consumes they have to be in an ansible place03:00
sdakeinstalled via pip i guess03:01
sdakenot sure how03:01
SamYapleWe need to fork Ansible to make this work without being hacky from my point-of-view03:01
sdakehacky is ok03:02
sdakethis ia short 1-2 month thing03:02
sdakegreg siad ansible comes out in aug03:02
SamYaplehacky as in not pip03:02
sdakewedont want to force people to install "our" version of ansible03:02
SamYaplehacky as in script that injects the files in the right place03:02
sdakepip will hide that hackiness ;)03:02
SamYaplecan pip install to arbitray locations?03:03
sdakegoogle knows the answer03:03
SamYapleI am unfamiliar with any python packaging methods, I only know how to consume03:04
sdakei can sort it out if you like03:04
SamYapleI would prefere a simple docs approach here since, as you say, these modules will be avialbe in two months03:04
sdakeyou mean like git pull followed by cp?03:05
SamYaplepretty much03:05
sdakeya we can sort something out03:07
sdakei am going to bed03:07
sdakenight03:07
SamYaplenight03:07
openstackgerritMerged stackforge/kolla: Add validation script for broken symlinks  https://review.openstack.org/19746503:26
openstackgerritMerged stackforge/kolla: Add link validation to pep8 gate  https://review.openstack.org/19746603:26
openstackgerritMerged stackforge/kolla: Add config-internal/config-external to Heat containers  https://review.openstack.org/19809803:27
openstackgerritMerged stackforge/kolla: Add config-internal/config-external to Swift containers  https://review.openstack.org/19814003:30
SamYapleharmw: sure would be nice to get these ansible bits merged in....03:53
SamYapleHINT HINT03:54
*** dims_ has quit IRC04:02
*** sdake has quit IRC04:33
*** sdake has joined #kolla04:44
sdakeevening folks04:45
sdakehey samyaple04:45
sdakepower nap ftw04:45
SamYaplepower nap as in now power reviews?!04:46
sdakeif you give me 30 mins to wake up a bit more04:46
sdakeand point out what you want reviewed04:47
SamYaple2004:47
sdakeI had the queue done pretty much from my perspective yesterday04:47
SamYapledoubtful...04:47
SamYapleoh nvm04:47
SamYaplemy days are wierd04:48
sdakemaybe itwas day before04:48
SamYapleno i pushed this morning04:48
sdakeeverything was in +2 state or -1 state that i could review04:48
SamYapleaka "last night"04:48
sdakewe have alot fo reviews that need abandon or rebase04:48
SamYapleagreed04:48
SamYaplehttps://review.openstack.org/#/c/196428/04:50
SamYaplehttps://review.openstack.org/#/c/197681/04:50
SamYaplehttps://review.openstack.org/#/c/197960/04:50
SamYapleand then maybe https://review.openstack.org/#/c/197581/04:50
SamYapleorder of priority ^04:50
*** vinkman has joined #kolla05:00
sdakeok let me get a smoke in05:09
sdakeand i'll review05:09
SamYaplenever! do it now!05:13
sdakeyay samyaple learned hwot o format todo proprely ;-)05:14
SamYaplei only had to be told once :/05:14
sdakewhat is this /tmp/mariadb_file?05:16
sdakeis that on the deploy node or on the target hosts05:16
SamYaplefile on the local deploy host05:16
SamYapleit only ever contains a hostname05:16
sdakeis there a way to make secure files?05:16
sdakelike mkfstemp or whatever05:16
SamYaplework around ansible nonsense05:16
sdaketh eissue is someone could put a file in /tmp that is a symlink05:17
sdakeansible could follow the symlink and do a write05:17
sdakeand nuke the system05:17
sdakecommon security problem05:17
SamYaplei mean that is just running a shell command, so we could do whatever we want05:18
*** vinkman has quit IRC05:19
SamYaplesdake: i would prefer to simply force the file to exist as a file, rather than a symlink05:26
SamYaplernadomness and ansible doesnt play well together05:26
sdakewhatever you can do to fix the security problem05:26
sdakeit will be flagged by distros if it  isn't right05:26
sdakeand block adoption05:26
sdakethey actually inspect every code that goes in05:26
sdakeif you can believe that. ;)05:26
sdakeatleast rht did.05:27
SamYaplefor the record, this is only on the deploy host, you recognize that, yes?05:27
sdakeyup05:28
SamYapleok05:28
sdakethat is more dnagerious then the other hosts05:28
SamYapledisagree05:28
sdakepeople could use it for something besides deploy and liely would05:28
sdakeliely05:28
sdakelikely05:28
SamYaplebut it still should be changed05:28
sdakethe point is it will be flagged05:28
sdakeso we will have to fix it sooner or later05:28
SamYapleim just going to rm the file as the first step05:28
sdakemight as well be sooner, or atleast keep track of it :)05:28
sdakethat isn't atomic05:29
sdakethat is why random is used all over the place in linux for these filenames ;)05:29
sdakejust file a bug05:29
sdakeits easier then fixin it properly immediately05:29
sdakeand not a blocker to merging the patch05:29
sdakebut blocker to liberty 205:29
SamYaplei will, but i remove the file later in that section anyway05:29
sdakeok well the issue is in the meantime ansible could write to th file correct?05:30
SamYaplewhat?05:30
sdakeprobably something over 50% of exploits involve insecure files in /tmp and symlink ;)05:30
SamYaplehence the rm before use05:30
sdakeyou rm it before use, their script spins and links05:31
sdakesometimes rm works sometimes it doesn't05:31
SamYapleso just monitor all files in tmp05:31
SamYaplea genreated file doesnt fix that05:31
sdakesurely ansible has temporary file creation that is secure?05:31
SamYapleif the file is created as root then all is good05:31
SamYaplewhat is your argument against rming the file if it exists before use?05:32
sdakelinux shell has one, called mkstemp05:32
SamYapleim aware05:32
sdakea bad actor coul dcreate a scrip that spins and symlinks that same file - sinc ethe filename is known ahead of time05:33
sdakeyou rm it, they symlink it05:34
sdakeyou write to it via ansible05:34
sdakepoof - system cracked05:34
sdakeor other bad actions happen05:34
SamYaplei would simple make a script to watch all files and catch any instance of a file named /tmp/***_XXXXXX05:34
SamYaplereplace that with a symlink then - poof system crack05:34
sdakestill racey05:34
SamYapleso is what youre saying05:34
SamYapleyou arent fixing the issue either05:34
sdakeright, that is why ansible probalby has a secure creation script05:34
SamYapleno05:35
sdakeit doesn't just have to be random it has to be atomic05:35
sdakei am pretty sure linux has a systemcall to do the job05:35
sdakebut not 100% certain05:35
SamYaplelisten youre missing the point, if the file is root, it is root it is root05:35
SamYaplei can simply cally mkstemp but that doesnt solve the theoritical issue you are talking about05:35
sdakemkstemp is atomic ;)05:36
sdakeit doesn't permit the race you described from occuring05:36
sdakebtw did you register for the midcycle05:37
SamYaplein the end, the file will be created. then a seperate task will be exectued giving time for the attacker to do something... .IF THEY HAVE UID 005:38
sdakeya if they have uid 0 - the problem is without mkstemp - a rm before allows someone to race for the file without uid 005:38
sdakeread the internet for more info don't argue with me about it05:38
SamYaplejesus dude. if that is your biggeswt concern i already said i can solve it by ensuring the file exists as a file owned by root05:39
sdakethe security nerds prefer mkstemp, i dont understand why05:40
sdakei personally dont care as long as our software ins't responsible for a cracked system05:40
SamYapleoh well?05:40
SamYaplebroken, not cracked05:40
SamYaplethe worst thing that could happen here is overwritting an arbitray file05:40
sdakethe security nerds didn't mkstemp for their health ;-)05:41
sdakeimplement mkstemp that is05:41
SamYapleWE CANT USE IT05:41
SamYaplei just said that05:41
sdakeenvironment variables dont persist is the issue there?05:42
SamYapledynamic + ansible doesnt work well. we can get all hacky with it, but thats going to cause things to be overlooked and be a bigger issue05:42
SamYaplethis is already using a "local_action" which is qierd for ansible05:42
sdakejust file a tech debt bug - problem solved05:42
SamYaplethings dont persist through tasks05:43
sdakeif you file a tech debt bug, i'll get a security nerd to look at it and make suggestions how to fix properly05:43
SamYaplethat doesnt solve the siseu, it just takes you out of the discussion. if thats what you want cool05:43
sdakeit does solve the isssue because i can get a security nerd to attach their name to the solution05:43
sdakesomeone that deal with this same argument over and over for 60 hrs a week at their job05:44
sdakevs me, who doesn't ;)05:44
sdakeimmovable rock (sam) meets unstoppable force (security nerd)05:46
sdakeshould be fun discussion :)05:46
SamYaplewhat am i unmovable about? I am calling you out on why what you said will not work, not the issue doesnt exist05:46
sdakei've completely given up on a rguing with the security dudes, i just do whatever they want05:46
SamYaplekeep trying to be condecending though05:47
sdakeI am not attaching my name to a security solution that may or may not be correct05:47
sdakeit was just a joke man05:47
sdakecalm down05:47
SamYapleso to merge this i need to file a bug for something that isnt merged yet?05:47
sdakeyes, point at the review #/file name/line #05:48
sdakeso we don't lose track of it05:48
sdakethen I can get a security dude to look at it05:48
sdakethat does that job for their full time gig05:48
sdakejust like I am not a lawyer, I am also not a security dude05:48
sdakesay title of bug is somethign like "possible symlink attack"05:49
sdakeor something05:49
sdakei'll try to get you guys to sync over the bug so there is a record05:50
sdakemakes sense?05:50
sdakewe should follow this practice whenever we run into security issues we can't immediately solve05:50
sdakerest of work looks really good - nice job btw05:52
SamYaplegoing to have to disagree on cant solve immediately, but im filing the bug in anycase05:53
sdakewere there more you wanted me to review?05:53
sdakethanks appreciate it :)05:53
sdakethe list you posted has scrolled - I'm not sure I got them all05:54
SamYaplehttps://review.openstack.org/#/c/196428/05:54
SamYapleadded the bug05:54
sdakethanks05:55
*** sdake_ has joined #kolla05:59
*** sdake has quit IRC06:02
SamYaplesdake_: https://review.openstack.org/#/c/197581/06:04
SamYaplethat was the only one i see left, but it isnt critical06:04
sdake_acked06:05
SamYaplethats for all the help06:07
SamYaplenow i just need to track another core so all this can hit the repo06:07
sdake_weekend - might be tough06:07
SamYapleyep06:07
sdake_since 4th fourth of july weeend06:07
SamYapleonce it lands though, we will be blocked by the modules and can properly figure that out06:07
sdake_ya now we ha ea workable solution tho06:08
sdake_and are unblocked there06:08
sdake_apologies for not understanding your original proposal06:08
sdake_I thought you meant to bring the code into the codebase, not keep it forked separately06:08
sdake_or this problem would already be fixed :(06:09
SamYaplewe can blame the drugs06:09
sdake_worst part is im out :)06:09
*** sdake_ is now known as sdake06:11
openstackgerritMerged stackforge/kolla: Ansible Mariadb w/ Galera support  https://review.openstack.org/19642806:51
openstackgerritMerged stackforge/kolla: Ansible Rabbitmq support  https://review.openstack.org/19768106:52
openstackgerritMerged stackforge/kolla: Updated keystone for wsgi in config-external  https://review.openstack.org/19796006:52
openstackgerritMerged stackforge/kolla: Improve the Kolla documentation  https://review.openstack.org/19758106:57
harmwsdake: could you perhaps sweep through the review queue somewhere this cycle to check if we're not leaving great stuff behind?06:59
SamYaplehey cool. so all of those bits are merged you guys can actually use ansible now07:01
vincent_vdkwhen I read the docs Kolla cannot be deployed on Fedora2207:22
vincent_vdkis this still the case07:22
SamYaplevincent_vdk: if you build Fedora images, it should work with Fedora2207:23
SamYaplethe centos images do not07:23
vincent_vdkok, bu tit has nothing to do with the host the containers run on07:24
SamYapleit does07:24
SamYaplebut the host isnt doing anything wrong07:24
SamYaplein Fedora22 they use xz compression for the modules, the containers load modules from the host, the centos containers canont load xz modules07:24
vincent_vdkah i see07:24
vincent_vdkbut an Ubuntu host should work07:25
SamYapleUbuntu host should work, yes07:26
SamYaplei dont think even 15.04 uses xz compressed modules07:26
SamYaplei know 14.04 doesnt07:26
vincent_vdkor an atomic host maybe07:26
openstackgerritSam Yaple proposed stackforge/kolla: Add new build script  https://review.openstack.org/19661707:34
openstackgerritHarm Weites proposed stackforge/kolla: Add config-internal/config-external to Neutron containers  https://review.openstack.org/19809108:18
SamYapleharmw: whats up08:22
harmwnot much, temperature here are skyrocketting08:23
harmw*is08:23
SamYaplewhere ata08:23
harmwNL08:23
harmwwhere we go from 20C to 35C in a matter of days08:24
SamYapleNorth Louisana?08:24
harmwno, I was more thinking of Holland ;)08:24
harmwEurope08:24
SamYaplethat makes more sense08:24
harmw:P08:24
SamYaplealso North Louisana isn't a thing08:25
SamYapleshoulda been my first clue08:25
harmwhehe08:25
harmwanyway, saturday morning here08:25
SamYaplesame08:25
harmwabout to go somewhere, away from laptop probably08:25
SamYaplewell 3am08:25
harmwlol08:26
harmwshouldn't you sleep at this time?08:26
harmw(it's 10:26AM here btw)08:26
SamYaplei work third shift. your timezone matches my schedule pretty closely08:26
harmwok, cool08:26
harmwshifts at rackspace, right?08:26
SamYapleyea08:27
harmwwhat do they make you do there :)08:27
SamYapleI support openstack-ansible for customers08:28
harmwok, cool, probably08:30
harmwwell, openstack is cool and so is ansible, but customers... well...08:30
harmw:p08:30
SamYapleansible is slick08:31
harmwso you have (or just take) time between answering tickets do work on stuff like Kolla then?08:31
SamYaplei get moments here and there08:32
SamYaplebut im the only one on third shift so they are few08:32
harmwcool08:33
*** pbourke has quit IRC09:26
*** pbourke has joined #kolla09:26
*** sdake has quit IRC09:49
*** sdake has joined #kolla09:51
*** diogogmt has quit IRC11:04
*** sdake has quit IRC11:12
openstackgerritSam Yaple proposed stackforge/kolla: Add new build script  https://review.openstack.org/19661711:16
openstackgerritSam Yaple proposed stackforge/kolla: Add new build script  https://review.openstack.org/19661711:25
*** britthouser has quit IRC12:20
*** dims_ has joined #kolla12:33
openstackgerritSam Yaple proposed stackforge/kolla: Ansible Glance support  https://review.openstack.org/19849412:51
openstackgerritSam Yaple proposed stackforge/kolla: Ansible Glance support  https://review.openstack.org/19849412:52
openstackgerritSam Yaple proposed stackforge/kolla: Ansible Glance support  https://review.openstack.org/19849412:54
SamYaplefolks. that is what a porrly done rebase looks like12:55
*** sdake has joined #kolla13:43
vincent_vdkharmw: to hot here too13:47
sdakemorning13:47
vincent_vdkgood afternoon sir :)13:47
*** dims_ has quit IRC13:47
vincent_vdkSamYaple: so you work at Rackspace. I would imagine you would work on OSAD :)13:48
*** dims_ has joined #kolla13:49
*** dims_ has quit IRC13:54
*** sdake has quit IRC13:54
*** sdake has joined #kolla13:57
vincent_vdkis there a reason to use includes of configs in the Ansible roles?13:57
vincent_vdk:q13:57
*** dims_ has joined #kolla14:16
*** dims_ has quit IRC14:21
*** britthouser has joined #kolla14:53
*** dims_ has joined #kolla15:12
*** dims_ has quit IRC15:29
SamYaplevincent_vdk: I do not work on OSAD15:37
SamYapleI am only support, i don't do dev for RAX15:37
SamYaplemorning sdake15:37
SamYaplevincent_vdk: are you refering to the templates, or the files that belong in /etc/kolla/config?15:38
*** Slower has quit IRC15:51
vincent_vdkSamYaple: the include of config.yml16:21
vincent_vdkincludes in roles to files outside the role are a bit weird imho16:21
vincent_vdkbut i'm just having a quick look atm16:22
*** sdake has quit IRC16:32
*** dims_ has joined #kolla17:18
*** bmace has quit IRC17:18
*** dims_ has quit IRC17:23
*** sdake has joined #kolla17:23
*** sdake has quit IRC17:28
*** sdake has joined #kolla17:35
*** sdake_ has joined #kolla17:42
*** sdake has quit IRC17:45
*** bmace has joined #kolla17:49
*** bmace has quit IRC17:58
*** mandre has quit IRC18:15
*** mandre has joined #kolla18:16
*** dims_ has joined #kolla19:02
*** mandre has quit IRC19:06
*** mandre has joined #kolla19:06
*** dims_ has quit IRC19:14
*** bmace has joined #kolla19:20
*** sdake has joined #kolla19:30
*** sdake_ has quit IRC19:34
openstackgerritMerged stackforge/kolla: Add config-internal/config-external to Nova-compute containers  https://review.openstack.org/19807519:56
openstackgerritMerged stackforge/kolla: Add base Nova image for Ubuntu  https://review.openstack.org/19676020:00
*** mandre has quit IRC20:03
*** mandre has joined #kolla20:04
*** mandre has quit IRC20:08
*** mandre has joined #kolla20:10
openstackgerritMerged stackforge/kolla: Add new script to fetch tarballs for source installation  https://review.openstack.org/19791920:11
openstackgerritMerged stackforge/kolla: Add config-internal/config-external to Glance containers  https://review.openstack.org/19776120:11
*** dims_ has joined #kolla20:14
*** dims_ has quit IRC20:19
*** sdake has quit IRC20:51
*** sdake has joined #kolla21:35
*** dims_ has joined #kolla22:16
*** dims_ has quit IRC22:21
*** sdake has quit IRC22:27
*** bmace is now known as bmace_away22:30
*** sdake has joined #kolla22:46
*** mandre has quit IRC22:49
*** mandre has joined #kolla22:50
*** dims_ has joined #kolla23:33
*** sdake_ has joined #kolla23:46
*** sdake has quit IRC23:49

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!