Skip to content

Change Container permissions to Private for provisioned Azure Volumes#47605

Merged
k8s-github-robot merged 1 commit into
kubernetes:masterfrom
brendandburns:container
Jun 16, 2017
Merged

Change Container permissions to Private for provisioned Azure Volumes#47605
k8s-github-robot merged 1 commit into
kubernetes:masterfrom
brendandburns:container

Conversation

@brendandburns

@brendandburns brendandburns commented Jun 15, 2017 •
edited by liggitt
Loading

Copy link
Copy Markdown
Contributor

@rootfs @philips #47611

Fixes CVE-2017-1002100

Azure: Change container permissions to private for provisioned volumes. If you have existing Azure volumes that were created by Kubernetes v1.6.0-v1.6.5, you should change the permissions on them manually.

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 15, 2017
@k8s-github-robot k8s-github-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. release-note-label-needed labels Jun 15, 2017
@brendandburns brendandburns added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-label-needed labels Jun 15, 2017
@brendandburns brendandburns changed the title Change Container permissions to Private. Change Container permissions to Private for provisioned Azure Volumes Jun 15, 2017
@brendandburns

brendandburns commented Jun 15, 2017

Copy link
Copy Markdown
Contributor Author

/approve no-issue

@rootfs

rootfs commented Jun 15, 2017

Copy link
Copy Markdown

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 15, 2017
@philips

philips commented Jun 15, 2017

Copy link
Copy Markdown
Contributor

/lgtm

@jdumars

jdumars commented Jun 15, 2017

Copy link
Copy Markdown
Contributor

/sig azure

@jdumars

jdumars commented Jun 15, 2017

Copy link
Copy Markdown
Contributor

/retest

@jdumars

jdumars commented Jun 15, 2017

Copy link
Copy Markdown
Contributor

/lgtm

@k8s-ci-robot

k8s-ci-robot commented Jun 15, 2017

Copy link
Copy Markdown
Contributor

@jdumars: changing LGTM is restricted to assignees, and only kubernetes org members may be assigned issues.

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@brendandburns brendandburns added this to the v1.7 milestone Jun 15, 2017
@brendandburns

brendandburns commented Jun 15, 2017

Copy link
Copy Markdown
Contributor Author

/approve no-issue

@brendandburns

brendandburns commented Jun 15, 2017

Copy link
Copy Markdown
Contributor Author

/approve

@k8s-github-robot

k8s-github-robot commented Jun 15, 2017

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: brendandburns, jdumars, philips, rootfs

Associated issue: 47611

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@k8s-github-robot k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 15, 2017
@brendandburns

brendandburns commented Jun 15, 2017

Copy link
Copy Markdown
Contributor Author

@k8s-bot pull-kubernetes-federation-e2e-gce test this

1 similar comment
@brendandburns

brendandburns commented Jun 15, 2017

Copy link
Copy Markdown
Contributor Author

@k8s-bot pull-kubernetes-federation-e2e-gce test this

@seanknox

seanknox commented Jun 15, 2017

Copy link
Copy Markdown

/retest

@brendandburns

brendandburns commented Jun 16, 2017

Copy link
Copy Markdown
Contributor Author

/retest

@brendandburns

brendandburns commented Jun 16, 2017

Copy link
Copy Markdown
Contributor Author

Flakes were due to #47610

Retesting...

@k8s-github-robot k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 16, 2017
@brendandburns brendandburns added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 16, 2017
@brendandburns

brendandburns commented Jun 16, 2017

Copy link
Copy Markdown
Contributor Author

self-lgtm since this was just a rebase.

@brendandburns

brendandburns commented Jun 16, 2017

Copy link
Copy Markdown
Contributor Author

@k8s-bot pull-kubernetes-e2e-gce-etcd3 test this

@k8s-github-robot

k8s-github-robot commented Jun 16, 2017

Copy link
Copy Markdown

Automatic merge from submit-queue (batch tested with PRs 47562, 47605)

@k8s-github-robot
k8s-github-robot merged commit 7831a54 into kubernetes:master Jun 16, 2017
@brendandburns brendandburns mentioned this pull request Jun 16, 2017
Merged
k8s-github-robot pushed a commit that referenced this pull request Jun 16, 2017
Merge pull request #47630 from brendandburns/automated-cherry-pick-of…
5b9fd7d 
…-#47605-upstream-release-1.6

Automatic merge from submit-queue

Automated cherry-pick of #47605

@enisoc @philips 

See #47605
@enisoc enisoc added the release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. label Jun 16, 2017
@philips

philips commented Jun 16, 2017

Copy link
Copy Markdown
Contributor

This fixes a security issue, see the release notes here: https://groups.google.com/forum/#!topic/kubernetes-announce/WodXsASu6y0

A vulnerability has been disclosed in which default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

The vulnerability is tracked in http://issue.k8s.io/47611, and fixed in release v1.6.6, available immediately. The fix is also included in the upcoming 1.7.0 release.

Who is affected?

Only Kubernetes 1.6.0-1.6.5 installations that have Persistent Volumes (PVs) actively provisioned through the Azure cloud provider are subject to the vulnerability. Clusters without PVs are unaffected. No other form of cluster storage is impacted.

What is the impact?

An individual with the full URI of an actively provisioned persistent volume can download the VHD file for that volume. It does not apply retroactively to volumes already deleted from the cluster.

How can I mitigate this prior to installing 1.6.6?

Permissions on running persistent volumes can be changed without affecting cluster operations using the Azure CLI or through the Azure web portal. A full procedure for both methods is available here: https://aka.ms/f5tslk

Azure Container Service rollout of 1.6.6 will begin immediately.

@liggitt liggitt mentioned this pull request Jul 20, 2017
Closed
mhan8796 pushed a commit to mhan8796/kubernetes that referenced this pull request Jun 26, 2026
Merge pull request kubernetes#47605 from brendandburns/container
3bd3409 
Automatic merge from submit-queue (batch tested with PRs 47562, 47605)

Change Container permissions to Private for provisioned Azure Volumes

@rootfs @philips kubernetes#47611
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@philips philips

@colemickens colemickens

@rootfs rootfs

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

v1.7

Development

Successfully merging this pull request may close these issues.