(RHSA-2015:0789) Important: openstack-packstack and openstack-puppet-modules security and bug fix update

PackStack is a command-line utility for deploying OpenStack on existing
servers over an SSH connection. Deployment options are provided either
interactively, using the command line, or non-interactively by means of a
text file containing a set of preconfigured values for OpenStack
parameters. PackStack is suitable for proof-of-concept installations.
PackStack is suitable for deploying proof-of-concept installations.

It was discovered that the puppet manifests, as provided with the
openstack-puppet-modules package, would configure the pcsd daemon with a
known default password. If this password was not changed and an attacker
was able to gain access to pcsd, they could potentially run shell commands
as root. (CVE-2015-1842)

This issue was discovered by Alessandro Vozza of Red Hat.

This update also fixes the following bugs:

• If OpenStack Networking is enabled, Packstack would display a warning if
  the Network Manager service is active on hosts. (BZ#1117277)

• A quiet dependency on a newer version of selinux-policy causes
  openstack-selinux 0.6.23 to fail to install modules when paired with
  selinux-policy packages from Red Hat Enterprise Linux 7.0 or 7.0.z.
  This causes Identity and other OpenStack services to receive ‘AVC’ denials
  and malfunction under some circumstances. The following workarounds allow
  the OpenStack services to function correctly:

1. Leave openstack-selinux at 0.6.18-2.el7ost until you are ready to update
   to Red Hat Enterprise Linux 7.1. At that time, a ‘yum update’ will resolve
   the issue.

2. Install the updated selinux-policy and selinux-policy-targeted packages
   from Red Hat Enterprise Linux 7.1 (version selinux-policy-3.13.1-23.el7 or
   later), then update openstack-selinux to version 0.6.23-1.el7ost.
   (BZ#1195252)

• A typo in the code caused a Sahara option that uses OpenStack Networking
  to be always false. Sahara now uses OpenStack Networking if the parameter
  'CONFIG_NEUTRON_INSTALL is set to ‘y’. (BZ#1199047)

• Prior to this update, users had to install the OpenStack Unified Client
  separately after an installation of Packstack. Packstack now installs it by
  default. (BZ#1199114)

• This enhancement updates Packstack to retain temporary directories when
  running an installation in debug mode. This assists with troubleshooting
  activities. As a result, temporary directories are not deleted when running
  Packstack with the --debug command line option. (BZ#1199565)

• Prior to this update, some validators did not use ‘validate_not_empty’ to
  ensure that certain parameters contained values. As a result, a number of
  internal validations could not be properly handled, leading to the
  possibility of unexpected errors. This update fixes validators to use
  validate_not_empty when required, resulting in correct validation behavior
  from validators. (BZ#11995889)

In addition to the above issues, this update also addresses bugs and
enhancements which can be found in the Red Hat Enterprise Linux OpenStack
Platform Technical Notes, linked to in the References section.

All openstack-packstack and openstack-puppet-modules users are advised to
upgrade to these updated packages, which correct these issues.