<br><br><div class="gmail_quote">On Wed, Aug 8, 2012 at 9:22 AM, Thierry Carrez <span dir="ltr"><<a href="mailto:thierry@openstack.org" target="_blank">thierry@openstack.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">Robert Kukura wrote:<br>
> On 08/08/2012 09:31 AM, Thierry Carrez wrote:<br>
</div><div class="im">>> Quantum currently contains bin/quantum-rootwrap, a copy of nova-rootwrap<br>
>> supposed to control its privilege escalation to run commands as root.<br>
>><br>
>> However quantum-rootwrap is currently non-functional, missing a lot of<br>
>> filter definitions that are necessary for it to work correctly.<br>
><br>
> Is missing definitions the only issue? Those may need updating for F-3,<br>
> but this can certainly be done.<br>
<br>
</div>Those are the only issues I spotted. Making Quantum compatible with the<br>
latest version of rootwrap as shipped in Nova/Cinder, though, is a lot<br>
more work.<br>
<div class="im"><br>
>> Quantum<br>
>> is generally run with root_helper=sudo and a wildcard sudoers file.<br>
><br>
> What is your basis for this statement? The packaging of Essex Quantum<br>
> for Fedora and RHEL/EPEL do configure root_helper to use<br>
> quantum-rootwrap. If another distribution doesn't do this, I would<br>
> consider that a distribution bug, not an upstream problem.<br>
<br>
</div>Given that quantum-rootwrap is currently non-working, I suspected that<br>
everyone running Quantum *on Folsom* was using sudo and not the<br>
rootwrap. If most people do that, it probably means it's a it early to<br>
deprecate root_helper=sudo support in Folsom.<br>
<div class="im"><br>
>> That<br>
>> means Quantum is not ready to deprecate in Folsom (and remove in<br>
>> Grizzly) its ability to run with root_helper=sudo, like Nova and Cinder do.<br>
><br>
> What's involved in deprecating this ability in Folsom? Is it that<br>
> difficult? If Nova and Cinder are doing it, why shouldn't Quantum?<br>
<br>
</div>As a quick grep will show, there is much more adherence to root_helper<br>
in Quantum than in Nova/Cinder, where it was used in a single place.<br>
It's definitely doable, but I'd say a bit dangerous (and too late) 4<br>
days before F3. I certainly won't have enough time for it...<br>
<div class="im"><br>
> I do have an issue with Folsom dropping a capability that is being used<br>
> in Essex. If the existing rootwrap really does more harm than good, this<br>
> might be justified, but I don't think you can argue nobody has used it.<br>
<br>
</div>Fair point, it was definitely used in Essex.<br>
<br>
We have three options at this point:<br>
<br>
* Remove it (but is it acceptable to "lose" functionality compared to<br>
Essex, even if Essex is not a "core" release for Quantum ?)<br>
<br>
* Just fix it by adding missing filters (but then accept that<br>
quantum-rootwrap doesn't behave like nova-rootwrap and cinder-rootwrap,<br>
which is bad for consistency)<br>
<br>
* Align quantum-rootwrap with nova-rootwrap and deprecate usage of<br>
root_helper, by overhauling how root_helper is pervasively used<br>
throughout Quantum code (lots of work, and introducing a lot of<br>
disruption that late in the cycle)<br>
<br>
Personally I think only the first two options are realistic. So this<br>
boils down to losing functionality from Essex vs. hurting Folsom core<br>
consistency.<br></blockquote><div><br></div><div>If someone (Bob?) has the immediate cycles to make rootwrap work in Folsom with low to medium risk of disruption, I'd be open to exploring that, even if it meant inconsistent usage in quantum vs. nova/cinder. </div>
<div><br></div><div>I also think we need to develop basic guidelines that should be enforced by reviewers with respect to correctly using rootwrap moving forward. Is there a quick pointer we have for developers and reviewers to use? </div>
<div><br></div><div>Dan</div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im HOEnZb"><br>
--<br>
Thierry Carrez (ttx)<br>
Release Manager, OpenStack<br>
<br>
</div><div class="HOEnZb"><div class="h5">_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>Dan Wendlandt <div>Nicira, Inc: <a href="http://www.nicira.com" target="_blank">www.nicira.com</a><br><div>twitter: danwendlandt<br>
~~~~~~~~~~~~~~~~~~~~~~~~~~~<br></div></div><br>