nova user can read kernel for libguestfs on Ubuntu

Problem: libvirt password/key injection uses libguestfs to mount the
guest filesystem. libguestfs uses a supermin appliance, and in order to
create this appliance, libguestfs (running as nova user) must read the
host's kernel. Unfortunately, Ubuntu sets file permissions which make
compressed kernels non-readable to non-root users, and this breaks
libvirt password/key injection on compute hosts running Ubuntu.

Solution: When compute hosts are running Ubuntu AND the deployer has
enabled libvirt password or SSH key injection, do the following:
- Run `dpkg-statoverride` to set file permissions on compressed
  kernel (/boot/vmlinuz-*), readable to group 'nova'
- Install a script which does same for each new kernel installed via
  system updates in the future

Related-Bug: #1507915
Change-Id: Ic96b69bb80ce11001b2ee5d63324a12b0f68456d

defaults/main.yml

@@ -288,6 +288,9 @@ nova_wsgi_processes: "{{ [[ansible_processor_vcpus|default(1), 1] | max * 2, nov
 nova_wsgi_buffer_size: 65535
 
 ## Nova libvirt
+# Warning: If nova_libvirt_inject_key or nova_libvirt_inject_password are enabled for Ubuntu compute hosts
+# then the kernel will be made readable to nova user (a requirement for libguestfs).
+# See Launchpad bugs 1507915 (Nova), 759725 (Ubuntu), and http://libguestfs.org/guestfs-faq.1.html
 nova_libvirt_inject_key: False
 # inject partition options:
 #  -2 => disable, -1 => inspect (libguestfs only), 0 => not partitioned, >0 => partition number

files/nova_kernel_permissions.sh

@@ -0,0 +1,20 @@
+#/bin/sh
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+version="$1"
+if [ -z "$version" ]; then
+  exit 0
+fi
+exec dpkg-statoverride --update --add root nova 0640 "/boot/vmlinuz-${version}"

tasks/nova_compute_kvm.yml

@@ -33,6 +33,12 @@
     - nova-config
     - nova-kvm
 
+- name: Set kernel permissions to enable libguestfs features (Ubuntu)
+  include: nova_kernel_permissions.yml
+  when:
+    - ansible_distribution == 'Ubuntu'
+    - nova_libvirt_inject_key | bool or nova_libvirt_inject_password | bool
+
 - name: Set libvirtd config
   template:
     src: libvirtd.conf.j2

tasks/nova_kernel_permissions.yml

@@ -0,0 +1,39 @@
+---
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Find installed kernels
+  find:
+    paths: '/boot'
+    patterns: 'vmlinuz-*'
+  register: kernels
+
+- name: Determine latest installed kernel
+  set_fact:
+    latest_kernel: "{{ kernels.files | map(attribute='path') | sort(reverse=True) | first }}"
+
+- name: Latest kernel readable to nova group/user
+  command: 'dpkg-statoverride --update --add root nova 0640 {{ latest_kernel }}'
+  register: dpkg_statoverride_result
+  changed_when: >
+    'an override for \'{{ latest_kernel }}\' already exists; aborting'
+    not in dpkg_statoverride_result.stderr
+  failed_when: >
+    (dpkg_statoverride_result.rc != 0) and
+    ('an override for \'{{ latest_kernel }}\' already exists; aborting'
+    not in dpkg_statoverride_result.stderr)
+
+- name: Script installed to make future kernels readable to nova group/user
+  copy:
+    src: 'nova_kernel_permissions.sh'
+    dest: '/etc/kernel/postinst.d/nova_kernel_permissions.sh'
+    mode: '0755'