[neutron][nova][large scale SIG] Rootwrap daemon and privsep

Thierry Carrez thierry at openstack.org
Tue Dec 3 09:39:58 UTC 2019

Matt Riedemann wrote:
> [...]
> I want to say mikal converted everything native to nova from rootwrap to 
> privsep and that was completed in Train:
> https://docs.openstack.org/releasenotes/nova/train.html#security-issues
> "The transition from rootwrap (or sudo) to privsep has been completed 
> for nova. The only case where rootwrap is still used is to start privsep 
> helpers. All other rootwrap configurations for nova may now be removed."
> Looking at what's in the compute.filters file looks like it's all stuff 
> for os-brick, but I though os-brick was fully using privsep natively as 
> well? Maybe it's just a matter of someone working on this TODO:
> https://opendev.org/openstack/nova/src/branch/master/etc/nova/rootwrap.d/compute.filters#L16 

That's great news! I'll have a deeper look and propose changes if 


Thierry Carrez (ttx)

More information about the openstack-discuss mailing list