security update

Aaron Weitekamp aweiteka at redhat.com
Mon Aug 20 13:09:24 UTC 2012


On 08/14/2012 04:57 PM, Mo Morsi wrote:
> Great! Appreciate the assistance.
>
> Up to this point the main focus has been on tightening up the Conductor
> webapp as thats the main entry point into the application. Other
> components including imagefactory and deltacloud could be looked at as
> well but in a full installation those aren't primarily user facing, and
> they should be able to be run in their own chroot'd sandboxes limiting
> possible attack vectors.
>
> With conductor I went through and audited the 0.4.0 release, comparing /
> contasting it against the rails best practices and general ruby coding
> guidelines. We've been using the wiki to track the progress and
> submitting patches in sets to the mailing list. The controller update is
> primarily done though more work needs to be done on the model side
> (including resolving any mass assignment vulnerabilities [1]). A diff
> would need to be done between the tagged release and the latest one to
> analyse recent additions.
>
> Maros has also been looking at integrating the best practices gem but
> not sure what the progress is on that. Last I heard there were some
> issues with running it on Fedora but those may have been resolved. Once
> that is working, I would like to leverage it and other ruby code metric
> tools to automate some of this security work.
>
> As far as work that needs tbd, tightening up the remaining tasks from
> the audit and integrating those tools in are of relative high priority.
> I would also like / having been pushing to get some infrastructure to
> host this so people can hammer on it. Any help on these fronts or
> anything in the general security / code quality direction would be more
> than appreciated, think we should be able to do something cool!
>
>    -Mo
>
> [1]
> https://lists.fedorahosted.org/pipermail/aeolus-devel/2012-July/011770.html

Mo, we have a draft of the CloudForms QE 1.1 Integration test plan that 
includes a limited security scope [1]. During brainstorming I developed 
a larger list [2] but most tests must be deferred due to lack of 
expertise, out of scope and time constraints. However, I was encouraged 
to learn from Kurt Seifried (SRT, Cloud products) that these types of 
concerns are on his mind for future releases. FWIW, Kurt has been 
impressed with the number of people concerned with security issues.


[1] Integration Test Plan, security tests: 
https://docspace.corp.redhat.com/docs/DOC-112731#Security_Tests
[2] Deferred tests: https://docspace.corp.redhat.com/docs/DOC-112900



More information about the aeolus-devel mailing list