openstack/kolla-ansible
Code Issues Proposed changes

Merge "[security] Make Ironic tftpd run as nobody"

Browse Source
This commit is contained in:
Zuul 2022-08-30 19:35:07 +00:00 committed by Gerrit Code Review
commit 490cb977c2
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/ironic/templates/ironic-tftp.json.j2
View File

@ -2,7 +2,7 @@
{% set pxe_cfg = 'grub.cfg' if enable_ironic_pxe_uefi | bool else 'default' %}
{
"command": "/usr/sbin/in.tftpd --verbose --foreground --user root --address 0.0.0.0:69 --map-file /map-file /var/lib/ironic/tftpboot",
"command": "/usr/sbin/in.tftpd --verbose --foreground --user nobody --address 0.0.0.0:69 --map-file /map-file /var/lib/ironic/tftpboot",
"config_files": [
{% if not ironic_dnsmasq_serve_ipxe | bool and groups['ironic-inspector'] | length > 0 %}
{% if not enable_ironic_pxe_uefi | bool %}

6
releasenotes/notes/ironic-tftp-nobody-835803ba36398ea3.yaml Normal file
View File

@ -0,0 +1,6 @@
---
security:
- |
Kolla Ansible used to run Ironic's tftpd as an (unprivileged) root
user.
Now, it will explicitly use the nobody user.