March 2018 - Zuul-announce - lists.opendev.org

zuul-jobs: Deprecation of the "emit-ara-html" role in favor of "ara-report"
by David Moreau Simard 14 Oct '18

14 Oct '18

Hello, The "emit-ara-html" [1] role, typically part of Zuul base jobs, has been used to generate ARA [2] static HTML Ansible reports. These files end up being stored as part of the logs of a job in the "ara" directory. This role has been superseded by "ara-report" [3] which provides the same functionality and defaults out of the box. This new role adds support for saving raw databases and is meant to be compatible with the use of the ARA sqlite WSGI middleware. This new middleware implementation may be of particular interest for Zuul operators since it translates to improved job performance and reduced storage overhead. For reference, the OpenStack Infrastructure implementation can be found here [4]. The announcement to openstack-dev can be found here [5] for additional details and context. Please refer to the ARA documentation for more details [6]. Feel free to reply to this thread or reach out to us in #zuul if you have any questions! [1]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/emit-ara-html [2]: https://github.com/openstack/ara [3]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/ara-report/README.rst [4]: https://review.openstack.org/#/q/project:openstack-infra/puppet-openstackci… [5]: http://lists.openstack.org/pipermail/openstack-dev/2018-March/128902.html [6]: https://ara.readthedocs.io/en/latest/advanced.html David Moreau Simard Senior Software Engineer | OpenStack RDO dmsimard = [irc, github, twitter]

1 1

Zuul 3.0.0 released
by corvus＠inaugust.com 29 Mar '18

29 Mar '18

I'm very pleased to announce that Zuul version 3.0.0 has been released! Zuul v3 is a major accomplishment that is the result of years of work and experience on some of the largest and fastest-paced Open-Source software projects. Zuul was developed for the OpenStack project, but is now being used by many other organizations, and this release reflects that change in focus. Zuul v3 is a significant change from previous versions. In short, it is a fully-featured system for project gating, continuous integration, and deployment. Features include: * Support for testing and gating Gerrit and GitHub projects * Jobs are written in Ansible, making integration of testing and production deployments easy * Pluggable providers for Nodepool; jobs can run on pre-existing static nodes or OpenStack clouds * Live testing of job configuration changes * Cross-project and cross-source testing with dependencies Thanks to the many contributors from all over the world who have worked very hard to improve Zuul. You can find more information about Zuul at https://zuul-ci.org/ Over the next weeks, you can expect us to continue to refine the website and documentation for new users, as well as produce new releases frequently as we improve Zuul. Thanks, James Blair, on behalf of the Zuul team

1 0

Zuul not blocking local execution of some Ansible modules
by Tobias.Henkel＠bmw.de 23 Mar '18

23 Mar '18

Dear zuul operators, I discovered that we don't check some Ansible modules for delegation to localhost. This would make it possible to overwrite any data which is writable within the bwrap context. Further the script module allows arbitrary code execution when delegated to localhost. This could also make it theoretically possible to escape out of the bubblewrap context using further kernel vulnerabilities. This is fixed by https://review.openstack.org/555435 and it is strongly advised to update asap to latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul speculative Ansible plugin injection
by Tobias.Henkel＠bmw.de 17 Mar '18

17 Mar '18

Dear zuul operators, Simon Westphahl and Felix Schmidt discovered that it is possible to inject and run speculative Ansible plugins within untrusted jobs. Plugins are executed locally on the executor and allow the execution of arbitrary python code (and thus also shell code) within the bubblewrap context. This could also make it theoretically possible to escape out of the bubblewrap context using further kernel vulnerabilities. This is fixed by https://review.openstack.org/553854 and it is strongly advised to update asap to latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul potential untrusted information disclosure using symlinks
by Tobias.Henkel＠bmw.de 15 Mar '18

15 Mar '18

Dear zuul operators, I discovered a security issue in zuul which allows untrusted speculative jobs to inspect the local file system of a zuul-executor. In the default configuration, access outside of the working directory is constrained by bubblewrap, so information disclosure should not be possible as long as bubblewrap is enabled. If bubblewrap was disabled (not the default, and not recommended), access to files outside of the working directory is possible. This is due to a flaw in the safe path check which doesn't check for symlinks hidden in sub directories or chained symlinks. This is fixed by https://review.openstack.org/553029 and it is advised to update to latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul flaw in json logging
by Tobias.Henkel＠bmw.de 15 Mar '18

15 Mar '18

Dear zuul operators Simon Westphahl discovered a flaw within json logging of zuul where no_log is ignored for ansible loops. Tasks within a loop may be able to print decrypted secrets in job-output.json, despite setting no_log. This is fixed in https://review.openstack.org/552799 by Simon. All operators are encouraged to take following actions: * Update your zuul * Check if any jobs dealing with secrets also deal with them in loops using no_log. If not, you're safe * If yes, check job-output.json if secrets are contained * If yes, change your secret Sorry for any inconveniences Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul untrusted information disclosure
by Tobias.Henkel＠bmw.de 13 Mar '18

13 Mar '18

Dear zuul operators, I recently discovered a security issue in zuul which allows untrusted speculative jobs to inspect the local file system of a zuul-executor. In the default configuration, access outside of the working directory is constrained by bubblewrap, so information disclosure should not be possible as long as bubblewrap is enabled. If bubblewrap was disabled (not the default, and not recommended), access to files outside of the working directory is possible. This is due to a flaw in the safe path check which didn't follow the search paths of ansible and thus couldn't dereference symlinks which may point to arbitrary locations in the executor file system. This issue is fixed by the changes https://review.openstack.org/552074 and https://review.openstack.org/552127 and it is strongly advised to update to the latest master. We're also currently working on similar classes of security issues so expect more fixes in the future. For the moment, running zuul without bubblewrap is considered unsafe. Sorry for any inconvenience Kind regards Your zuul team -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0