| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add protection tests for trusts API https://review.opendev.org/675720 | 00:29 |
|---|---|---|
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies https://review.opendev.org/675807 | 00:30 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move delete_trust enforcement to default policies https://review.opendev.org/676277 | 00:30 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_trust enforcement to default policies https://review.opendev.org/676283 | 00:33 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_roles_for_trust enforcement to policies https://review.opendev.org/676284 | 00:33 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_role_for_trust enforcement to policies https://review.opendev.org/676287 | 00:33 |
| *** gyee has quit IRC | 00:34 | |
| *** markvoelker has joined #openstack-keystone | 00:45 | |
| *** markvoelker has quit IRC | 00:50 | |
| *** markvoelker has joined #openstack-keystone | 01:03 | |
| *** spsurya has joined #openstack-keystone | 01:14 | |
| *** dklyle has quit IRC | 01:18 | |
| *** dave-mccowan has joined #openstack-keystone | 01:38 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system reader role for trusts API https://review.opendev.org/676847 | 01:49 |
| *** markvoelker has quit IRC | 01:51 | |
| *** markvoelker has joined #openstack-keystone | 02:35 | |
| *** markvoelker has quit IRC | 02:40 | |
| *** dave-mccowan has quit IRC | 03:12 | |
| *** markvoelker has joined #openstack-keystone | 04:00 | |
| *** markvoelker has quit IRC | 04:04 | |
| *** gagehugo has quit IRC | 04:25 | |
| *** gagehugo has joined #openstack-keystone | 04:26 | |
| *** markvoelker has joined #openstack-keystone | 04:30 | |
| *** markvoelker has quit IRC | 04:35 | |
| *** jaosorior has quit IRC | 04:40 | |
| *** markvoelker has joined #openstack-keystone | 07:05 | |
| *** markvoelker has quit IRC | 07:10 | |
| *** trident has quit IRC | 08:03 | |
| *** ivve has joined #openstack-keystone | 08:07 | |
| *** trident has joined #openstack-keystone | 08:11 | |
| *** jaosorior has joined #openstack-keystone | 08:11 | |
| *** jaosorior has quit IRC | 08:11 | |
| *** tkajinam has quit IRC | 08:27 | |
| *** jaosorior has joined #openstack-keystone | 09:02 | |
| *** jaosorior has quit IRC | 09:41 | |
| *** jaosorior has joined #openstack-keystone | 09:44 | |
| *** markvoelker has joined #openstack-keystone | 10:01 | |
| *** markvoelker has quit IRC | 10:10 | |
| *** jaosorior has quit IRC | 10:35 | |
| *** markvoelker has joined #openstack-keystone | 10:45 | |
| *** markvoelker has quit IRC | 10:50 | |
| *** markvoelker has joined #openstack-keystone | 11:48 | |
| kmalloc | Looks like we will need the extension on the resource options. Power is out in my neighborhood (still) | 12:09 |
| *** raildo has joined #openstack-keystone | 12:26 | |
| *** raildo has quit IRC | 12:45 | |
| *** raildo has joined #openstack-keystone | 12:50 | |
| kmalloc | cmurphy: ^ | 12:53 |
| kmalloc | Estimated restoration is this afternoon sometime. | 12:53 |
| kmalloc | Maybe. | 12:53 |
| *** raildo_ has joined #openstack-keystone | 13:10 | |
| *** raildo has quit IRC | 13:12 | |
| cmurphy | kmalloc: okie | 13:14 |
| *** rmascena__ has joined #openstack-keystone | 13:40 | |
| *** raildo_ has quit IRC | 13:43 | |
| *** rmascena__ has quit IRC | 14:00 | |
| *** raildo has joined #openstack-keystone | 14:01 | |
| *** dave-mccowan has joined #openstack-keystone | 14:22 | |
| *** dave-mccowan has quit IRC | 14:35 | |
| *** bnemec is now known as beekneemech | 14:48 | |
| *** cmurphy is now known as cmorpheus | 14:48 | |
| *** ivve has quit IRC | 14:57 | |
| *** dklyle has joined #openstack-keystone | 15:05 | |
| *** gyee has joined #openstack-keystone | 15:12 | |
| *** Garyx has joined #openstack-keystone | 15:17 | |
| *** gyee has quit IRC | 15:35 | |
| cmorpheus | some easy reviews https://review.opendev.org/676662 https://review.opendev.org/676659 https://review.opendev.org/674208 https://review.opendev.org/674211 https://review.opendev.org/668795 | 15:42 |
| *** gyee has joined #openstack-keystone | 15:48 | |
| *** gyee has quit IRC | 15:52 | |
| kmalloc | cmorpheus: all:+2/+A | 16:01 |
| cmorpheus | ty | 16:02 |
| kmalloc | :) | 16:02 |
| *** gyee has joined #openstack-keystone | 16:08 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: Bump the openstackdocstheme extension to 1.20 https://review.opendev.org/668795 | 16:11 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Blacklist sphinx 2.1.0 (autodoc bug) https://review.opendev.org/674208 | 16:13 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Bump the openstackdocstheme extension to 1.20 https://review.opendev.org/674211 | 16:13 |
| openstackgerrit | Merged openstack/keystone master: Update cli docs https://review.opendev.org/676659 | 16:18 |
| openstackgerrit | Merged openstack/keystone master: Update broken link https://review.opendev.org/676662 | 16:19 |
| *** bnemec has joined #openstack-keystone | 16:19 | |
| *** beekneemech has quit IRC | 16:19 | |
| *** bnemec is now known as beekneemech | 16:20 | |
| *** beekneemech has quit IRC | 16:32 | |
| *** bnemec has joined #openstack-keystone | 16:35 | |
| *** bnemec has quit IRC | 16:44 | |
| *** bnemec has joined #openstack-keystone | 16:45 | |
| *** ivve has joined #openstack-keystone | 16:49 | |
| *** ivve has quit IRC | 16:49 | |
| *** bnemec has quit IRC | 17:02 | |
| openstackgerrit | Nikita Kalyanov proposed openstack/keystone master: Fix caching behavior https://review.opendev.org/676991 | 17:02 |
| *** bnemec has joined #openstack-keystone | 17:03 | |
| *** ivve has joined #openstack-keystone | 17:09 | |
| *** markvoelker has quit IRC | 17:10 | |
| *** bnemec has quit IRC | 17:14 | |
| *** bnemec has joined #openstack-keystone | 17:15 | |
| *** markvoelker has joined #openstack-keystone | 17:18 | |
| openstackgerrit | Nikita Kalyanov proposed openstack/keystone master: Add decryption of credentials https://review.opendev.org/676992 | 17:29 |
| *** bnemec has quit IRC | 17:31 | |
| *** bnemec has joined #openstack-keystone | 17:34 | |
| *** dklyle has quit IRC | 17:40 | |
| *** bnemec has quit IRC | 17:40 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system reader role for trusts API https://review.opendev.org/676847 | 17:41 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for system member for trusts https://review.opendev.org/676995 | 17:41 |
| *** bnemec has joined #openstack-keystone | 17:42 | |
| *** ivve has quit IRC | 18:07 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system reader role for trusts API https://review.opendev.org/676847 | 18:21 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for system member for trusts https://review.opendev.org/676995 | 18:21 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system admin for trusts API https://review.opendev.org/677004 | 18:21 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system reader role for trusts API https://review.opendev.org/676847 | 18:56 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for system member for trusts https://review.opendev.org/676995 | 18:56 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system admin for trusts API https://review.opendev.org/677004 | 18:56 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for domain users for trusts https://review.opendev.org/677020 | 18:56 |
| *** bnemec is now known as beekneemech | 20:14 | |
| *** markvoelker has quit IRC | 20:25 | |
| *** markvoelker has joined #openstack-keystone | 20:30 | |
| *** markvoelker has quit IRC | 20:33 | |
| *** markvoelker has joined #openstack-keystone | 20:33 | |
| *** pcaruana has quit IRC | 20:57 | |
| *** raildo has quit IRC | 21:10 | |
| *** markvoelker has quit IRC | 21:12 | |
| kmalloc | cmorpheus: commented on the trust-existence leaking bug | 21:36 |
| kmalloc | cmorpheus, gyee: I expect that we should be consistent in keystone, i don't think grants (or other delegations) were ever intended to be public knowledge. They are also not explicitly meant to be non-public (secure) knowledge. I err to the side of consistency within keystone's behaviors when addressing minimization of security surface area (social engineering, extra targets to attempt to attack to gain | 21:37 |
| kmalloc | access, etc) | 21:37 |
| kmalloc | and adam is not here to chime in *shrug* | 21:38 |
| gyee | kmalloc, even if non-trustee can't get a token? | 21:41 |
| kmalloc | correct | 21:41 |
| kmalloc | i would expect the data to be generally not available if the user is not party to the delegation | 21:41 |
| kmalloc | e.g. Cloud Admin (all delegations are relevant), Project/Domain Admin (depending on policy), Trustor, Trustee | 21:42 |
| kmalloc | because other delegations (grants, et al) are not visible to non-party members | 21:42 |
| kmalloc | even if that non-party is a valid keystone user. | 21:42 |
| kmalloc | now, i am just going by consistency within keystone about data accessibility | 21:43 |
| kmalloc | i don't want ot make grants free access even if someone can't get a token ;) | 21:43 |
| gyee | I am purely looking at it from risk standpoint | 21:44 |
| cmorpheus | i guess the question is whether this is severe enough to warrant breaking the API contract | 21:44 |
| kmalloc | this is not super critical, but is security-adjacent as it gives potential information for other attack subjects to gain access. but it's a C1, you have to guess a UUID. sooooo | 21:44 |
| kmalloc | i'm going to say it's a valid bug | 21:44 |
| gyee | so per my understanding, risk = threat x vulnerability | 21:44 |
| kmalloc | it may not be worth breaking the api contract | 21:44 |
| kmalloc | e.g. "Wont Fix" vs "Invalid": | 21:44 |
| cmorpheus | yeah | 21:44 |
| gyee | there is threat, but no vulnerability, so therefore low risk | 21:44 |
| kmalloc | hence C1. | 21:45 |
| kmalloc | vs anything else. | 21:45 |
| gyee | from API standpoint, yes, we should fix it for consistency | 21:45 |
| gyee | to seal the threat | 21:45 |
| kmalloc | so, like i said, it's inconsistent within keystone. it may simply be a Wont Fix due to api contract/behavior | 21:45 |
| kmalloc | but it is definitely a valid bug. | 21:46 |
| kmalloc | if that makes sense :) | 21:46 |
| gyee | yeah I agree it is a valid bug, may not be a security bug though | 21:46 |
| kmalloc | most of the time C1 is security-adjacent in my experience | 21:46 |
| gyee | gray area :-) | 21:47 |
| kmalloc | if it was any more worrisome than "hey, it's data and could be relevant in other vectors of attack", it would be a class A | 21:47 |
| kmalloc | it provides no direct vector of attack | 21:47 |
| kmalloc | and the threat assessment is low. | 21:47 |
| gyee | sometimes security theater is worst than actual risk | 21:47 |
| kmalloc | but it is security-related :) | 21:47 |
| kmalloc | it may even warrant an OSSN saying "yeah, we know, not worth the headache of fixing" | 21:48 |
| kmalloc | "but it's a thing" | 21:48 |
| kmalloc | so i *think* the answer here is... do we care about the consistency of this not-public-but-not-sensitive data? or the API Contract more. there is no wrong answer | 21:48 |
| cmorpheus | ugh | 21:49 |
| kmalloc | realistically all answers are fine. | 21:49 |
| kmalloc | and i support both sides. I hadn't realized we had an argument in the bug about validity :P | 21:50 |
| kmalloc | or i would have -1 Workflowed it rather than +A, and then made the same comment :) | 21:50 |
| gyee | hah, our API contract didn't explain the error codes https://github.com/openstack/keystone/blob/master/api-ref/source/v3-ext/trust.inc | 21:51 |
| kmalloc | nope | 21:51 |
| kmalloc | =/ | 21:51 |
| cmorpheus | i think adam is going a little far by claiming it's "public" information but i can see the point that it can't really be used as leverage in an attack | 21:52 |
| kmalloc | exactly | 21:52 |
| cmorpheus | so i'm inclined to wontfix even though it's gross and makes me sad | 21:52 |
| kmalloc | lets call it Wont Fix, known thing. | 21:52 |
| kmalloc | sorry you spent so much time on fixing it | 21:52 |
| gyee | if its *public* information, why even bother to put a authorization policy on it :-) | 21:52 |
| cmorpheus | lol | 21:53 |
| kmalloc | gyee: nothing in keystone is *public* except the auth endpoint and json_home | 21:53 |
| cmorpheus | let's just publish a list of uuids | 21:53 |
| kmalloc | :P | 21:53 |
| kmalloc | cmorpheus: Done, let me spin up a patch that publishes every UUID in the database... not for what API it attaches to, just a list.. of every uuid...maybe some extra ones that we just randomly generate for good effect | 21:54 |
| cmorpheus | kmalloc: it was a relatively easy fix in the middle of the harder mess of untangling the hardcoded policy enforcment | 21:54 |
| cmorpheus | kmalloc: lol | 21:54 |
| gyee | whahhhh | 21:54 |
| kmalloc | hehe | 21:54 |
| kmalloc | anyway | 21:54 |
| kmalloc | yeah lets wont fix it, nothing wrong, might still warrant an OSSN | 21:54 |
| gyee | no argument here | 21:55 |
| kmalloc | marked as wont fix, commented about the IRC discussion | 21:58 |
| kmalloc | covered what we said and that this is minimal to no risk | 21:58 |
| cmorpheus | thanks kmalloc | 21:59 |
| kmalloc | np :) | 21:59 |
| gyee | kmalloc, but I agree with you, but attacker also manage to capture a user token, then jackpot | 21:59 |
| kmalloc | the data can be used to determine whom to target | 21:59 |
| kmalloc | but it also requires guessing UUIDs. | 21:59 |
| kmalloc | so.. good luck? | 22:00 |
| gyee | probably easier winning the lottery | 22:00 |
| kmalloc | or being struck by lightning... twice ... in the same spot | 22:00 |
| cmorpheus | so now i have to add protection tests that verify this behavior >.< | 22:02 |
| *** markvoelker has joined #openstack-keystone | 22:10 | |
| *** markvoelker has quit IRC | 22:15 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add protection tests for trusts API https://review.opendev.org/675720 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies https://review.opendev.org/675807 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move delete_trust enforcement to default policies https://review.opendev.org/676277 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_trust enforcement to default policies https://review.opendev.org/676283 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_roles_for_trust enforcement to policies https://review.opendev.org/676284 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_role_for_trust enforcement to policies https://review.opendev.org/676287 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system reader role for trusts API https://review.opendev.org/676847 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for system member for trusts https://review.opendev.org/676995 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for domain users for trusts https://review.opendev.org/677020 | 22:22 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Implement system admin for trusts API https://review.opendev.org/677004 | 22:22 |
| *** spsurya has quit IRC | 22:23 | |
| cmorpheus | beekneemech: oslo feature freeze won't apply to oslo.limit since we're still at 0.1 right? | 23:24 |
| kmalloc | cmorpheus: :( | 23:25 |
| *** vesper11 has quit IRC | 23:32 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!