*** mandre has joined #kolla | 00:22 | |
*** bradjones has quit IRC | 00:28 | |
*** ogelbukh1 has quit IRC | 00:34 | |
*** erkules_ has joined #kolla | 01:28 | |
*** erkules has quit IRC | 01:31 | |
*** bmace has quit IRC | 02:16 | |
*** dims_ has joined #kolla | 02:17 | |
*** bmace has joined #kolla | 02:28 | |
*** ogelbukh1 has joined #kolla | 02:35 | |
SamYaple | sdake i is here | 02:43 |
---|---|---|
sdake | samyaple did you see post on ml | 02:52 |
sdake | greg seems to be ok with the for approach | 02:52 |
sdake | fork | 02:52 |
SamYaple | yea | 02:53 |
SamYaple | but im not quite shure what to make of it all | 02:53 |
SamYaple | so fork of modules only in seperate repo, and we just pip install them/ | 02:54 |
sdake | fork and maintain only the stuf fwe need and make it pip installabble | 02:54 |
sdake | yup | 02:54 |
SamYaple | did legal get looped in on that? | 02:54 |
SamYaple | i had recommended that originally and yo usaid no | 02:54 |
sdake | i dont recall you recommending that | 02:55 |
sdake | if you did I guess I was drugged | 02:55 |
SamYaple | i said forked in seperate repo that we could pull in | 02:55 |
SamYaple | i did not use the word 'pip' | 02:55 |
sdake | i see | 02:56 |
sdake | pull in to me = mege into repo | 02:56 |
SamYaple | "seperate repo" | 02:56 |
SamYaple | but its cool, as long as legal is ok since that was teh reason you rejected it | 02:57 |
sdake | nah the reason I rejected it is I thought you were goin to pull them into our repo | 02:58 |
sdake | IANAL | 02:58 |
sdake | but if its a separate gplv3 repo | 02:58 |
sdake | it doesn't affect us at all | 02:58 |
SamYaple | thats what i said, but we will say the drugs prevented decent communication | 02:58 |
sdake | possible i was feeling pretty miserable when we originally discussed it a week ago | 02:59 |
sdake | so there is a repo there in my github | 02:59 |
sdake | go crazy :) | 02:59 |
SamYaple | i saw | 02:59 |
SamYaple | my question is how will these be installed? To where. These aren't regular modules that python consumes they have to be in an ansible place | 03:00 |
sdake | installed via pip i guess | 03:01 |
sdake | not sure how | 03:01 |
SamYaple | We need to fork Ansible to make this work without being hacky from my point-of-view | 03:01 |
sdake | hacky is ok | 03:02 |
sdake | this ia short 1-2 month thing | 03:02 |
sdake | greg siad ansible comes out in aug | 03:02 |
SamYaple | hacky as in not pip | 03:02 |
sdake | wedont want to force people to install "our" version of ansible | 03:02 |
SamYaple | hacky as in script that injects the files in the right place | 03:02 |
sdake | pip will hide that hackiness ;) | 03:02 |
SamYaple | can pip install to arbitray locations? | 03:03 |
sdake | google knows the answer | 03:03 |
SamYaple | I am unfamiliar with any python packaging methods, I only know how to consume | 03:04 |
sdake | i can sort it out if you like | 03:04 |
SamYaple | I would prefere a simple docs approach here since, as you say, these modules will be avialbe in two months | 03:04 |
sdake | you mean like git pull followed by cp? | 03:05 |
SamYaple | pretty much | 03:05 |
sdake | ya we can sort something out | 03:07 |
sdake | i am going to bed | 03:07 |
sdake | night | 03:07 |
SamYaple | night | 03:07 |
openstackgerrit | Merged stackforge/kolla: Add validation script for broken symlinks https://review.openstack.org/197465 | 03:26 |
openstackgerrit | Merged stackforge/kolla: Add link validation to pep8 gate https://review.openstack.org/197466 | 03:26 |
openstackgerrit | Merged stackforge/kolla: Add config-internal/config-external to Heat containers https://review.openstack.org/198098 | 03:27 |
openstackgerrit | Merged stackforge/kolla: Add config-internal/config-external to Swift containers https://review.openstack.org/198140 | 03:30 |
SamYaple | harmw: sure would be nice to get these ansible bits merged in.... | 03:53 |
SamYaple | HINT HINT | 03:54 |
*** dims_ has quit IRC | 04:02 | |
*** sdake has quit IRC | 04:33 | |
*** sdake has joined #kolla | 04:44 | |
sdake | evening folks | 04:45 |
sdake | hey samyaple | 04:45 |
sdake | power nap ftw | 04:45 |
SamYaple | power nap as in now power reviews?! | 04:46 |
sdake | if you give me 30 mins to wake up a bit more | 04:46 |
sdake | and point out what you want reviewed | 04:47 |
SamYaple | 20 | 04:47 |
sdake | I had the queue done pretty much from my perspective yesterday | 04:47 |
SamYaple | doubtful... | 04:47 |
SamYaple | oh nvm | 04:47 |
SamYaple | my days are wierd | 04:48 |
sdake | maybe itwas day before | 04:48 |
SamYaple | no i pushed this morning | 04:48 |
sdake | everything was in +2 state or -1 state that i could review | 04:48 |
SamYaple | aka "last night" | 04:48 |
sdake | we have alot fo reviews that need abandon or rebase | 04:48 |
SamYaple | agreed | 04:48 |
SamYaple | https://review.openstack.org/#/c/196428/ | 04:50 |
SamYaple | https://review.openstack.org/#/c/197681/ | 04:50 |
SamYaple | https://review.openstack.org/#/c/197960/ | 04:50 |
SamYaple | and then maybe https://review.openstack.org/#/c/197581/ | 04:50 |
SamYaple | order of priority ^ | 04:50 |
*** vinkman has joined #kolla | 05:00 | |
sdake | ok let me get a smoke in | 05:09 |
sdake | and i'll review | 05:09 |
SamYaple | never! do it now! | 05:13 |
sdake | yay samyaple learned hwot o format todo proprely ;-) | 05:14 |
SamYaple | i only had to be told once :/ | 05:14 |
sdake | what is this /tmp/mariadb_file? | 05:16 |
sdake | is that on the deploy node or on the target hosts | 05:16 |
SamYaple | file on the local deploy host | 05:16 |
SamYaple | it only ever contains a hostname | 05:16 |
sdake | is there a way to make secure files? | 05:16 |
sdake | like mkfstemp or whatever | 05:16 |
SamYaple | work around ansible nonsense | 05:16 |
sdake | th eissue is someone could put a file in /tmp that is a symlink | 05:17 |
sdake | ansible could follow the symlink and do a write | 05:17 |
sdake | and nuke the system | 05:17 |
sdake | common security problem | 05:17 |
SamYaple | i mean that is just running a shell command, so we could do whatever we want | 05:18 |
*** vinkman has quit IRC | 05:19 | |
SamYaple | sdake: i would prefer to simply force the file to exist as a file, rather than a symlink | 05:26 |
SamYaple | rnadomness and ansible doesnt play well together | 05:26 |
sdake | whatever you can do to fix the security problem | 05:26 |
sdake | it will be flagged by distros if it isn't right | 05:26 |
sdake | and block adoption | 05:26 |
sdake | they actually inspect every code that goes in | 05:26 |
sdake | if you can believe that. ;) | 05:26 |
sdake | atleast rht did. | 05:27 |
SamYaple | for the record, this is only on the deploy host, you recognize that, yes? | 05:27 |
sdake | yup | 05:28 |
SamYaple | ok | 05:28 |
sdake | that is more dnagerious then the other hosts | 05:28 |
SamYaple | disagree | 05:28 |
sdake | people could use it for something besides deploy and liely would | 05:28 |
sdake | liely | 05:28 |
sdake | likely | 05:28 |
SamYaple | but it still should be changed | 05:28 |
sdake | the point is it will be flagged | 05:28 |
sdake | so we will have to fix it sooner or later | 05:28 |
SamYaple | im just going to rm the file as the first step | 05:28 |
sdake | might as well be sooner, or atleast keep track of it :) | 05:28 |
sdake | that isn't atomic | 05:29 |
sdake | that is why random is used all over the place in linux for these filenames ;) | 05:29 |
sdake | just file a bug | 05:29 |
sdake | its easier then fixin it properly immediately | 05:29 |
sdake | and not a blocker to merging the patch | 05:29 |
sdake | but blocker to liberty 2 | 05:29 |
SamYaple | i will, but i remove the file later in that section anyway | 05:29 |
sdake | ok well the issue is in the meantime ansible could write to th file correct? | 05:30 |
SamYaple | what? | 05:30 |
sdake | probably something over 50% of exploits involve insecure files in /tmp and symlink ;) | 05:30 |
SamYaple | hence the rm before use | 05:30 |
sdake | you rm it before use, their script spins and links | 05:31 |
sdake | sometimes rm works sometimes it doesn't | 05:31 |
SamYaple | so just monitor all files in tmp | 05:31 |
SamYaple | a genreated file doesnt fix that | 05:31 |
sdake | surely ansible has temporary file creation that is secure? | 05:31 |
SamYaple | if the file is created as root then all is good | 05:31 |
SamYaple | what is your argument against rming the file if it exists before use? | 05:32 |
sdake | linux shell has one, called mkstemp | 05:32 |
SamYaple | im aware | 05:32 |
sdake | a bad actor coul dcreate a scrip that spins and symlinks that same file - sinc ethe filename is known ahead of time | 05:33 |
sdake | you rm it, they symlink it | 05:34 |
sdake | you write to it via ansible | 05:34 |
sdake | poof - system cracked | 05:34 |
sdake | or other bad actions happen | 05:34 |
SamYaple | i would simple make a script to watch all files and catch any instance of a file named /tmp/***_XXXXXX | 05:34 |
SamYaple | replace that with a symlink then - poof system crack | 05:34 |
sdake | still racey | 05:34 |
SamYaple | so is what youre saying | 05:34 |
SamYaple | you arent fixing the issue either | 05:34 |
sdake | right, that is why ansible probalby has a secure creation script | 05:34 |
SamYaple | no | 05:35 |
sdake | it doesn't just have to be random it has to be atomic | 05:35 |
sdake | i am pretty sure linux has a systemcall to do the job | 05:35 |
sdake | but not 100% certain | 05:35 |
SamYaple | listen youre missing the point, if the file is root, it is root it is root | 05:35 |
SamYaple | i can simply cally mkstemp but that doesnt solve the theoritical issue you are talking about | 05:35 |
sdake | mkstemp is atomic ;) | 05:36 |
sdake | it doesn't permit the race you described from occuring | 05:36 |
sdake | btw did you register for the midcycle | 05:37 |
SamYaple | in the end, the file will be created. then a seperate task will be exectued giving time for the attacker to do something... .IF THEY HAVE UID 0 | 05:38 |
sdake | ya if they have uid 0 - the problem is without mkstemp - a rm before allows someone to race for the file without uid 0 | 05:38 |
sdake | read the internet for more info don't argue with me about it | 05:38 |
SamYaple | jesus dude. if that is your biggeswt concern i already said i can solve it by ensuring the file exists as a file owned by root | 05:39 |
sdake | the security nerds prefer mkstemp, i dont understand why | 05:40 |
sdake | i personally dont care as long as our software ins't responsible for a cracked system | 05:40 |
SamYaple | oh well? | 05:40 |
SamYaple | broken, not cracked | 05:40 |
SamYaple | the worst thing that could happen here is overwritting an arbitray file | 05:40 |
sdake | the security nerds didn't mkstemp for their health ;-) | 05:41 |
sdake | implement mkstemp that is | 05:41 |
SamYaple | WE CANT USE IT | 05:41 |
SamYaple | i just said that | 05:41 |
sdake | environment variables dont persist is the issue there? | 05:42 |
SamYaple | dynamic + ansible doesnt work well. we can get all hacky with it, but thats going to cause things to be overlooked and be a bigger issue | 05:42 |
SamYaple | this is already using a "local_action" which is qierd for ansible | 05:42 |
sdake | just file a tech debt bug - problem solved | 05:42 |
SamYaple | things dont persist through tasks | 05:43 |
sdake | if you file a tech debt bug, i'll get a security nerd to look at it and make suggestions how to fix properly | 05:43 |
SamYaple | that doesnt solve the siseu, it just takes you out of the discussion. if thats what you want cool | 05:43 |
sdake | it does solve the isssue because i can get a security nerd to attach their name to the solution | 05:43 |
sdake | someone that deal with this same argument over and over for 60 hrs a week at their job | 05:44 |
sdake | vs me, who doesn't ;) | 05:44 |
sdake | immovable rock (sam) meets unstoppable force (security nerd) | 05:46 |
sdake | should be fun discussion :) | 05:46 |
SamYaple | what am i unmovable about? I am calling you out on why what you said will not work, not the issue doesnt exist | 05:46 |
sdake | i've completely given up on a rguing with the security dudes, i just do whatever they want | 05:46 |
SamYaple | keep trying to be condecending though | 05:47 |
sdake | I am not attaching my name to a security solution that may or may not be correct | 05:47 |
sdake | it was just a joke man | 05:47 |
sdake | calm down | 05:47 |
SamYaple | so to merge this i need to file a bug for something that isnt merged yet? | 05:47 |
sdake | yes, point at the review #/file name/line # | 05:48 |
sdake | so we don't lose track of it | 05:48 |
sdake | then I can get a security dude to look at it | 05:48 |
sdake | that does that job for their full time gig | 05:48 |
sdake | just like I am not a lawyer, I am also not a security dude | 05:48 |
sdake | say title of bug is somethign like "possible symlink attack" | 05:49 |
sdake | or something | 05:49 |
sdake | i'll try to get you guys to sync over the bug so there is a record | 05:50 |
sdake | makes sense? | 05:50 |
sdake | we should follow this practice whenever we run into security issues we can't immediately solve | 05:50 |
sdake | rest of work looks really good - nice job btw | 05:52 |
SamYaple | going to have to disagree on cant solve immediately, but im filing the bug in anycase | 05:53 |
sdake | were there more you wanted me to review? | 05:53 |
sdake | thanks appreciate it :) | 05:53 |
sdake | the list you posted has scrolled - I'm not sure I got them all | 05:54 |
SamYaple | https://review.openstack.org/#/c/196428/ | 05:54 |
SamYaple | added the bug | 05:54 |
sdake | thanks | 05:55 |
*** sdake_ has joined #kolla | 05:59 | |
*** sdake has quit IRC | 06:02 | |
SamYaple | sdake_: https://review.openstack.org/#/c/197581/ | 06:04 |
SamYaple | that was the only one i see left, but it isnt critical | 06:04 |
sdake_ | acked | 06:05 |
SamYaple | thats for all the help | 06:07 |
SamYaple | now i just need to track another core so all this can hit the repo | 06:07 |
sdake_ | weekend - might be tough | 06:07 |
SamYaple | yep | 06:07 |
sdake_ | since 4th fourth of july weeend | 06:07 |
SamYaple | once it lands though, we will be blocked by the modules and can properly figure that out | 06:07 |
sdake_ | ya now we ha ea workable solution tho | 06:08 |
sdake_ | and are unblocked there | 06:08 |
sdake_ | apologies for not understanding your original proposal | 06:08 |
sdake_ | I thought you meant to bring the code into the codebase, not keep it forked separately | 06:08 |
sdake_ | or this problem would already be fixed :( | 06:09 |
SamYaple | we can blame the drugs | 06:09 |
sdake_ | worst part is im out :) | 06:09 |
*** sdake_ is now known as sdake | 06:11 | |
openstackgerrit | Merged stackforge/kolla: Ansible Mariadb w/ Galera support https://review.openstack.org/196428 | 06:51 |
openstackgerrit | Merged stackforge/kolla: Ansible Rabbitmq support https://review.openstack.org/197681 | 06:52 |
openstackgerrit | Merged stackforge/kolla: Updated keystone for wsgi in config-external https://review.openstack.org/197960 | 06:52 |
openstackgerrit | Merged stackforge/kolla: Improve the Kolla documentation https://review.openstack.org/197581 | 06:57 |
harmw | sdake: could you perhaps sweep through the review queue somewhere this cycle to check if we're not leaving great stuff behind? | 06:59 |
SamYaple | hey cool. so all of those bits are merged you guys can actually use ansible now | 07:01 |
vincent_vdk | when I read the docs Kolla cannot be deployed on Fedora22 | 07:22 |
vincent_vdk | is this still the case | 07:22 |
SamYaple | vincent_vdk: if you build Fedora images, it should work with Fedora22 | 07:23 |
SamYaple | the centos images do not | 07:23 |
vincent_vdk | ok, bu tit has nothing to do with the host the containers run on | 07:24 |
SamYaple | it does | 07:24 |
SamYaple | but the host isnt doing anything wrong | 07:24 |
SamYaple | in Fedora22 they use xz compression for the modules, the containers load modules from the host, the centos containers canont load xz modules | 07:24 |
vincent_vdk | ah i see | 07:24 |
vincent_vdk | but an Ubuntu host should work | 07:25 |
SamYaple | Ubuntu host should work, yes | 07:26 |
SamYaple | i dont think even 15.04 uses xz compressed modules | 07:26 |
SamYaple | i know 14.04 doesnt | 07:26 |
vincent_vdk | or an atomic host maybe | 07:26 |
openstackgerrit | Sam Yaple proposed stackforge/kolla: Add new build script https://review.openstack.org/196617 | 07:34 |
openstackgerrit | Harm Weites proposed stackforge/kolla: Add config-internal/config-external to Neutron containers https://review.openstack.org/198091 | 08:18 |
SamYaple | harmw: whats up | 08:22 |
harmw | not much, temperature here are skyrocketting | 08:23 |
harmw | *is | 08:23 |
SamYaple | where ata | 08:23 |
harmw | NL | 08:23 |
harmw | where we go from 20C to 35C in a matter of days | 08:24 |
SamYaple | North Louisana? | 08:24 |
harmw | no, I was more thinking of Holland ;) | 08:24 |
harmw | Europe | 08:24 |
SamYaple | that makes more sense | 08:24 |
harmw | :P | 08:24 |
SamYaple | also North Louisana isn't a thing | 08:25 |
SamYaple | shoulda been my first clue | 08:25 |
harmw | hehe | 08:25 |
harmw | anyway, saturday morning here | 08:25 |
SamYaple | same | 08:25 |
harmw | about to go somewhere, away from laptop probably | 08:25 |
SamYaple | well 3am | 08:25 |
harmw | lol | 08:26 |
harmw | shouldn't you sleep at this time? | 08:26 |
harmw | (it's 10:26AM here btw) | 08:26 |
SamYaple | i work third shift. your timezone matches my schedule pretty closely | 08:26 |
harmw | ok, cool | 08:26 |
harmw | shifts at rackspace, right? | 08:26 |
SamYaple | yea | 08:27 |
harmw | what do they make you do there :) | 08:27 |
SamYaple | I support openstack-ansible for customers | 08:28 |
harmw | ok, cool, probably | 08:30 |
harmw | well, openstack is cool and so is ansible, but customers... well... | 08:30 |
harmw | :p | 08:30 |
SamYaple | ansible is slick | 08:31 |
harmw | so you have (or just take) time between answering tickets do work on stuff like Kolla then? | 08:31 |
SamYaple | i get moments here and there | 08:32 |
SamYaple | but im the only one on third shift so they are few | 08:32 |
harmw | cool | 08:33 |
*** pbourke has quit IRC | 09:26 | |
*** pbourke has joined #kolla | 09:26 | |
*** sdake has quit IRC | 09:49 | |
*** sdake has joined #kolla | 09:51 | |
*** diogogmt has quit IRC | 11:04 | |
*** sdake has quit IRC | 11:12 | |
openstackgerrit | Sam Yaple proposed stackforge/kolla: Add new build script https://review.openstack.org/196617 | 11:16 |
openstackgerrit | Sam Yaple proposed stackforge/kolla: Add new build script https://review.openstack.org/196617 | 11:25 |
*** britthouser has quit IRC | 12:20 | |
*** dims_ has joined #kolla | 12:33 | |
openstackgerrit | Sam Yaple proposed stackforge/kolla: Ansible Glance support https://review.openstack.org/198494 | 12:51 |
openstackgerrit | Sam Yaple proposed stackforge/kolla: Ansible Glance support https://review.openstack.org/198494 | 12:52 |
openstackgerrit | Sam Yaple proposed stackforge/kolla: Ansible Glance support https://review.openstack.org/198494 | 12:54 |
SamYaple | folks. that is what a porrly done rebase looks like | 12:55 |
*** sdake has joined #kolla | 13:43 | |
vincent_vdk | harmw: to hot here too | 13:47 |
sdake | morning | 13:47 |
vincent_vdk | good afternoon sir :) | 13:47 |
*** dims_ has quit IRC | 13:47 | |
vincent_vdk | SamYaple: so you work at Rackspace. I would imagine you would work on OSAD :) | 13:48 |
*** dims_ has joined #kolla | 13:49 | |
*** dims_ has quit IRC | 13:54 | |
*** sdake has quit IRC | 13:54 | |
*** sdake has joined #kolla | 13:57 | |
vincent_vdk | is there a reason to use includes of configs in the Ansible roles? | 13:57 |
vincent_vdk | :q | 13:57 |
*** dims_ has joined #kolla | 14:16 | |
*** dims_ has quit IRC | 14:21 | |
*** britthouser has joined #kolla | 14:53 | |
*** dims_ has joined #kolla | 15:12 | |
*** dims_ has quit IRC | 15:29 | |
SamYaple | vincent_vdk: I do not work on OSAD | 15:37 |
SamYaple | I am only support, i don't do dev for RAX | 15:37 |
SamYaple | morning sdake | 15:37 |
SamYaple | vincent_vdk: are you refering to the templates, or the files that belong in /etc/kolla/config? | 15:38 |
*** Slower has quit IRC | 15:51 | |
vincent_vdk | SamYaple: the include of config.yml | 16:21 |
vincent_vdk | includes in roles to files outside the role are a bit weird imho | 16:21 |
vincent_vdk | but i'm just having a quick look atm | 16:22 |
*** sdake has quit IRC | 16:32 | |
*** dims_ has joined #kolla | 17:18 | |
*** bmace has quit IRC | 17:18 | |
*** dims_ has quit IRC | 17:23 | |
*** sdake has joined #kolla | 17:23 | |
*** sdake has quit IRC | 17:28 | |
*** sdake has joined #kolla | 17:35 | |
*** sdake_ has joined #kolla | 17:42 | |
*** sdake has quit IRC | 17:45 | |
*** bmace has joined #kolla | 17:49 | |
*** bmace has quit IRC | 17:58 | |
*** mandre has quit IRC | 18:15 | |
*** mandre has joined #kolla | 18:16 | |
*** dims_ has joined #kolla | 19:02 | |
*** mandre has quit IRC | 19:06 | |
*** mandre has joined #kolla | 19:06 | |
*** dims_ has quit IRC | 19:14 | |
*** bmace has joined #kolla | 19:20 | |
*** sdake has joined #kolla | 19:30 | |
*** sdake_ has quit IRC | 19:34 | |
openstackgerrit | Merged stackforge/kolla: Add config-internal/config-external to Nova-compute containers https://review.openstack.org/198075 | 19:56 |
openstackgerrit | Merged stackforge/kolla: Add base Nova image for Ubuntu https://review.openstack.org/196760 | 20:00 |
*** mandre has quit IRC | 20:03 | |
*** mandre has joined #kolla | 20:04 | |
*** mandre has quit IRC | 20:08 | |
*** mandre has joined #kolla | 20:10 | |
openstackgerrit | Merged stackforge/kolla: Add new script to fetch tarballs for source installation https://review.openstack.org/197919 | 20:11 |
openstackgerrit | Merged stackforge/kolla: Add config-internal/config-external to Glance containers https://review.openstack.org/197761 | 20:11 |
*** dims_ has joined #kolla | 20:14 | |
*** dims_ has quit IRC | 20:19 | |
*** sdake has quit IRC | 20:51 | |
*** sdake has joined #kolla | 21:35 | |
*** dims_ has joined #kolla | 22:16 | |
*** dims_ has quit IRC | 22:21 | |
*** sdake has quit IRC | 22:27 | |
*** bmace is now known as bmace_away | 22:30 | |
*** sdake has joined #kolla | 22:46 | |
*** mandre has quit IRC | 22:49 | |
*** mandre has joined #kolla | 22:50 | |
*** dims_ has joined #kolla | 23:33 | |
*** sdake_ has joined #kolla | 23:46 | |
*** sdake has quit IRC | 23:49 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!