openstack/zun
Code Issues Proposed changes
3d150141b7
zun/devstack
History
Hongbin Lu d412de7100 Introduce rootwrap and filter 
If the zun-compute process is owned by a user who doesn't have
passwordless sudo privilege, zun-compute will fail to run
privileged command (e.g. sudo privsep-helper ...).

A native solution is to grant passwordless sudo to the user
who owns the zun process, but the best practice is to leverage
Rootwrap [1], which can restrict the privilege escalation.

This patch make Zun leverage Rootwrap. In particular, it does
the following:
* Setup Rootwrap in the Zun devstack plugin
* Introduce a sample rootwrap config file
* Introduce sample rootwrap filters for executing privsep-helper
* Introduce a root helper which basically adds "sudo zun-rootwrap"
  to the beginning of the command to be execute.
* Initialize privsep to use the Zun's root helper

[1] https://wiki.openstack.org/wiki/Rootwrap

Closes-Bug: #1749342
Needed-By: I69c47d25fa53f8e08efad9daa71d2f550425a5e7
Change-Id: I3ca5d853588b3705cb6cb2410df16e16a621c030
2018-03-14 04:36:33 +00:00
..
lib Introduce rootwrap and filter 2018-03-14 04:36:33 +00:00
local.conf.sample Set capability_scope to global in devstack 2017-12-05 04:29:40 +00:00
local.conf.subnode.sample Set capability_scope to global in devstack 2017-12-05 04:29:40 +00:00
plugin.sh Remove LIBS_FROM_GIT from the plugin code 2017-11-23 11:35:06 +08:00
README.rst Merge "Consolidate devstack config into sample" 2017-11-25 21:25:35 +00:00
settings Remove SCREEN_LOGDIR from devstack setting 2017-09-21 14:32:48 +05:30

README.rst

DevStack Integration

This directory contains the files necessary to integrate zun with devstack.

Refer the quickstart guide at https://docs.openstack.org/zun/latest/contributor/quickstart.html for more information on using devstack and zun.