<HTML>
<HEAD>
<TITLE>Re: [Openstack] Question on nova disk injection...</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Why couldn’t nova just escalate pythons privileges to the super user when writing a file (thus allowing it to use python file writing functions and such).<BR>
<BR>
Then after it writes it could drop it back to down to some other user?<BR>
<BR>
That might make sense, idk, instead of having the disk injection act like a shell script which basically just emits a bunch of [tee, mv, touch, mkdir, cp] commands.<BR>
<BR>
I’ve done something like this for anvil, not sure if its useful here but who knows:<BR>
<BR>
<a href="https://github.com/yahoo/Openstack-Anvil/blob/master/anvil/shell.py#L70">https://github.com/yahoo/Openstack-Anvil/blob/master/anvil/shell.py#L70</a><BR>
<BR>
On 6/5/12 2:50 PM, "Russell Bryant" <<a href="rbryant@redhat.com">rbryant@redhat.com</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>On 06/05/2012 05:42 PM, Joshua Harlow wrote:<BR>
> Hi all,<BR>
><BR>
> Just some questions that I had about how nova is doing disk injection<BR>
> and such.<BR>
><BR>
> I was noticing that it the main disk/api.py does a lot of tee, cat and<BR>
> similar commands. Is there any reason it couldn’t just use the standard<BR>
> python open and write data and such.<BR>
><BR>
> Is it because of sudo access (which is connected to rootwrap?), just<BR>
> wondering since it seems sort of odd that to write a file there a tee<BR>
> call has to be done with piped input, when python already has file<BR>
> operators and such...<BR>
<BR>
Yes, if it is using run_as_root=True, then it has to be run with<BR>
nova-rootwrap.<BR>
<BR>
--<BR>
Russell Bryant<BR>
<BR>
_______________________________________________<BR>
Mailing list: <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><BR>
Post to : <a href="openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><BR>
Unsubscribe : <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><BR>
More help : <a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a><BR>
<BR>
</SPAN></FONT></BLOCKQUOTE>
</BODY>
</HTML>