Re: [Openstack-operators] Venom vulnerability

2015-06-04 Thread Fox, Kevin M
...@gmail.commailto:clsacrame...@gmail.com] Sent: Thursday, June 04, 2015 8:05 AM To: Fox, Kevin M Cc: Steve Gordon; OpenStack Operations Mailing List Subject: Re: [Openstack-operators] Venom vulnerability Hi, I dit not update my ceph client. The version before and after is: # ceph -v ceph version

Re: [Openstack-operators] Venom vulnerability

2015-06-04 Thread Fox, Kevin M
For the record, what version of ceph are you using before and after? Thanks, Kevin From: Cynthia Lopes Sent: Thursday, June 04, 2015 1:27:53 AM To: Steve Gordon Cc: OpenStack Operations Mailing List Subject: Re: [Openstack-operators] Venom vulnerability Hi guys

Re: [Openstack-operators] Venom vulnerability

2015-06-04 Thread Cynthia Lopes
Operations Mailing List *Subject:* Re: [Openstack-operators] Venom vulnerability Hi guys, Just for feedback and if somebody else has compute nodes on CentOS 7.0, IceHouse and uses Ceph. -- What I did that worked for me

Re: [Openstack-operators] Venom vulnerability

2015-06-04 Thread Cynthia Lopes
Hi guys, Just for feedback and if somebody else has compute nodes on CentOS 7.0, IceHouse and uses Ceph. -- What I did that worked for me: -- #Remove all QEMU and Livirt related

Re: [Openstack-operators] Venom vulnerability

2015-06-02 Thread Tim Bell
To: Sławek Kapłoński Cc: openstack-operators@lists.openstack.org Subject: Re: [Openstack-operators] Venom vulnerability Hi guys, I had to recompile qemu-kvm on CentOS7 to enable RBD and be able to use CEPH. Now, what is the best to update for venom vulnerability? Has anyone already recompiled

Re: [Openstack-operators] Venom vulnerability

2015-06-02 Thread Cynthia Lopes
Hi guys, I had to recompile qemu-kvm on CentOS7 to enable RBD and be able to use CEPH. Now, what is the best to update for venom vulnerability? Has anyone already recompiled the patched sources and put it in a repository, or the only way is to get the knew sources and recompile again ? In

Re: [Openstack-operators] Venom vulnerability

2015-06-02 Thread Erik McCormick
/linux/enterprise/7Server/en/RHEV/SRPMS/ -Erik *From:* Cynthia Lopes [mailto:clsacrame...@gmail.com] *Sent:* 02 June 2015 10:57 *To:* Sławek Kapłoński *Cc:* openstack-operators@lists.openstack.org *Subject:* Re: [Openstack-operators] Venom vulnerability Hi guys, I had to recompile qemu

Re: [Openstack-operators] Venom vulnerability

2015-05-14 Thread James Page
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi Basil On 14/05/15 16:04, Basil Baby wrote: I can see the patch for CVE-2015-3456 updated to qemu-kvm package on Precise - Icehouse branch. https://launchpad.net/~ubuntu-cloud-archive/+archive/ubuntu/icehouse-s taging/+build/7425816

Re: [Openstack-operators] Venom vulnerability

2015-05-14 Thread Basil Baby
.openstack.org openstack-operators@lists.openstack.orgmailto: openstack-operators@lists .openstack.org Subject: Re: [Openstack-operators] Venom vulnerability honestly that seems like a very useful feature to ask for... specifically for upgrading qemu. -matt On Wed, May 13, 2015

Re: [Openstack-operators] Venom vulnerability

2015-05-14 Thread Sławek Kapłoński
Hello, So if I understand You correct, it is not so dangeorus if I'm using ibvirt with apparmor and this libvirt is adding apparmor rules for every qemu process, yes? -- Best regards / Pozdrawiam Sławek Kapłoński sla...@kaplonski.pl On Wed, May 13, 2015 at 04:01:05PM +0100, Daniel P. Berrange

Re: [Openstack-operators] Venom vulnerability

2015-05-14 Thread Favyen Bastani
On 05/14/2015 05:23 PM, Sławek Kapłoński wrote: Hello, So if I understand You correct, it is not so dangeorus if I'm using ibvirt with apparmor and this libvirt is adding apparmor rules for every qemu process, yes? You should certainly verify that apparmor rules are enabled for the qemu

[Openstack-operators] Venom vulnerability

2015-05-13 Thread Tim Bell
Looking through the details of the Venom vulnerability, https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/, it would appear that the QEMU processes need to be restarted. Our understanding is thus that a soft reboot of the VM is not sufficient but a hard one would be OK. Some

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread Joe Topjian
Hello, Looking through the details of the Venom vulnerability, https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/, it would appear that the QEMU processes need to be restarted. Our understanding is thus that a soft reboot of the VM is not sufficient but a hard one would be

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread Matt Van Winkle
-operators] Venom vulnerability Looking through the details of the Venom vulnerability, https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/, it would appear that the QEMU processes need to be restarted. Our understanding is thus that a soft reboot of the VM is not sufficient

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread Daniel P. Berrange
On Wed, May 13, 2015 at 02:31:26PM +, Tim Bell wrote: Looking through the details of the Venom vulnerability, https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/, it would appear that the QEMU processes need to be restarted. Our understanding is thus that a soft reboot of

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread Favyen Bastani
@lists.openstack.orgmailto:openstack-operators@lists.openstack.org Subject: Re: [Openstack-operators] Venom vulnerability honestly that seems like a very useful feature to ask for... specifically for upgrading qemu. -matt On Wed, May 13, 2015 at 11:19 AM, Daniel P. Berrange berra...@redhat.commailto:berra

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread Matt Van Winkle
-operators@lists .openstack.org openstack-operators@lists.openstack.orgmailto:openstack-operators@lists .openstack.org Subject: Re: [Openstack-operators] Venom vulnerability honestly that seems like a very useful feature to ask for... specifically for upgrading qemu. -matt On Wed, May 13

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread Matt Van Winkle
-operators@lists.openstack.orgmailto:openstack-operators@lists.openstack.org openstack-operators@lists.openstack.orgmailto:openstack-operators@lists.openstack.org Subject: Re: [Openstack-operators] Venom vulnerability honestly that seems like a very useful feature to ask for... specifically

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread David Medberry
Hi Tim, et al, We (Time Warner Cable) will be doing a live-migration (L-M) of all instances one the QEMU package is upgraded. That will start new QEMU instances on the target host allowing us to vacate the source host. We may roll in a kernel upgrade due to another security vulnerability at the

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread matt
honestly that seems like a very useful feature to ask for... specifically for upgrading qemu. -matt On Wed, May 13, 2015 at 11:19 AM, Daniel P. Berrange berra...@redhat.com wrote: On Wed, May 13, 2015 at 03:08:47PM +, Matt Van Winkle wrote: So far, your assessment is spot on from what

Re: [Openstack-operators] Venom vulnerability

2015-05-13 Thread Joe Topjian
To: Daniel P. Berrange berra...@redhat.com Cc: Matt Van Winkle mvanw...@rackspace.com, openstack-operators@lists.openstack.org openstack-operators@lists.openstack.org Subject: Re: [Openstack-operators] Venom vulnerability honestly that seems like a very useful feature to ask