documentation_complete: true

prodtype: osp7

title: 'Check-Compute-01: Is user/group ownership of config files set to root/nova?'

description: |-
    Configuration files contain critical parameters and information required for smooth functioning of the component. If an unprivileged user, either intentionally or accidentally modifies or deletes any of the parameters or the file itself then it would cause severe availability issues causing a denial of service to the other end users. Thus user ownership of such critical configuration files must be set to root and group ownership must be set to nova.
    <br />
    <br />
    Run the following commands:

    <br />
    <br />
    <tt>
    $ stat -L -c "%U %G" /etc/nova/nova.conf | egrep "root nova"
    <br />
    $ stat -L -c "%U %G" /etc/nova/api-paste.ini | egrep "root nova"
    <br />
    $ stat -L -c "%U %G" /etc/nova/policy.json | egrep "root nova"
    <br />
    $ stat -L -c "%U %G" /etc/nova/rootwrap.conf | egrep "root nova"
    </tt>
    <br />
    <br />
    Pass: If user and group ownership of all these config files is set to root and nova respectively. The above commands show output of root nova.
    <br />
    <br />

    Fail: If the above commands does not return any output as the user and group ownership might have set to any user other than root or any group other than nova.

rationale: ""

severity: unknown
