openstack/devstack
Code Issues Proposed changes

Add sudoers.d entry for Ironic conductor

Browse Source 
Ironic conductor requires sudo access for ironic-rootwrap.

Change-Id: Ic6f24a864ca0255e2a8e69969f347bcaf8493e1f
This commit is contained in:
Adam Gandelman 2014-04-14 16:14:33 -07:00
parent 404fbfefe2
commit 3f2a7b75bb
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/ironic
View File

@ -170,6 +170,15 @@ function configure_ironic_api {
function configure_ironic_conductor { function configure_ironic_conductor {
cp $IRONIC_DIR/etc/ironic/rootwrap.conf $IRONIC_ROOTWRAP_CONF cp $IRONIC_DIR/etc/ironic/rootwrap.conf $IRONIC_ROOTWRAP_CONF
cp -r $IRONIC_DIR/etc/ironic/rootwrap.d $IRONIC_CONF_DIR cp -r $IRONIC_DIR/etc/ironic/rootwrap.d $IRONIC_CONF_DIR
IRONIC_ROOTWRAP=$(get_rootwrap_location ironic)
ROOTWRAP_ISUDOER_CMD="$IRONIC_ROOTWRAP $IRONIC_CONF_DIR/rootwrap.conf *"
# Set up the rootwrap sudoers for ironic
TEMPFILE=`mktemp`
echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_ISUDOER_CMD" >$TEMPFILE
chmod 0440 $TEMPFILE
sudo chown root:root $TEMPFILE
sudo mv $TEMPFILE /etc/sudoers.d/ironic-rootwrap
iniset $IRONIC_CONF_FILE DEFAULT rootwrap_config $IRONIC_ROOTWRAP_CONF iniset $IRONIC_CONF_FILE DEFAULT rootwrap_config $IRONIC_ROOTWRAP_CONF
iniset $IRONIC_CONF_FILE DEFAULT drivers_whitelist $IRONIC_DRIVERS_WHITELIST iniset $IRONIC_CONF_FILE DEFAULT drivers_whitelist $IRONIC_DRIVERS_WHITELIST