)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"7d2fe2a57b02426ab14dae4b353abb07025b7665","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add /usr/local/bin to exec_dirs in rootwrap.conf"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"devstack installs some of the neutron utilities into /usr/local/bin:"},{"line_number":10,"context_line":"neutron-keepalived-state-change and neutron-ns-metadata-proxy."},{"line_number":11,"context_line":"In stead of adding individual filters to allow them to run from that"},{"line_number":12,"context_line":"directory, this patch adds /usr/local/bin into exec_dirs."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"bab921fb_cac4e593","line":9,"updated":"2015-04-23 01:30:10.000000000","message":"all the binaries get installed here","commit_id":"617d0d4b76175478abc92fa2e7cdb33a7422761b"},{"author":{"_account_id":6685,"name":"Baodong (Robert) Li","email":"baoli@cisco.com","username":"baoli"},"change_message_id":"2728959b823e65de49370128ee8bba3fcb9eadb7","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add /usr/local/bin to exec_dirs in rootwrap.conf"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"devstack installs some of the neutron utilities into /usr/local/bin:"},{"line_number":10,"context_line":"neutron-keepalived-state-change and neutron-ns-metadata-proxy."},{"line_number":11,"context_line":"In stead of adding individual filters to allow them to run from that"},{"line_number":12,"context_line":"directory, this patch adds /usr/local/bin into exec_dirs."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"bab921fb_ce1aa36e","line":9,"in_reply_to":"bab921fb_cac4e593","updated":"2015-04-23 13:36:17.000000000","message":"done","commit_id":"617d0d4b76175478abc92fa2e7cdb33a7422761b"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"7d2fe2a57b02426ab14dae4b353abb07025b7665","unresolved":false,"context_lines":[{"line_number":9,"context_line":"devstack installs some of the neutron utilities into /usr/local/bin:"},{"line_number":10,"context_line":"neutron-keepalived-state-change and neutron-ns-metadata-proxy."},{"line_number":11,"context_line":"In stead of adding individual filters to allow them to run from that"},{"line_number":12,"context_line":"directory, this patch adds /usr/local/bin into exec_dirs."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iade8b5b09bb53018485c85f8372fb94dbc2ad2da"},{"line_number":15,"context_line":"Closes-Bug: 1435971"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"bab921fb_4a0575c0","line":12,"updated":"2015-04-23 01:30:10.000000000","message":"so everything *is* in /usr/local/bin\n\nis it just these two that need to run under rootwrap?  if so, I think we *should* special-case them ... because it\u0027s much easier to add things that require rootwrap into some list than at some later time decide that security needs to be tightened and try and create a white-list retrospectively.  \n\nand that info should be in neutron (white-list these particular things for rootwrap) because you don\u0027t want that kept separately in devstack.\n\nif these are not the only things requiring this ... then how is this working at the moment?","commit_id":"617d0d4b76175478abc92fa2e7cdb33a7422761b"},{"author":{"_account_id":6685,"name":"Baodong (Robert) Li","email":"baoli@cisco.com","username":"baoli"},"change_message_id":"2728959b823e65de49370128ee8bba3fcb9eadb7","unresolved":false,"context_lines":[{"line_number":9,"context_line":"devstack installs some of the neutron utilities into /usr/local/bin:"},{"line_number":10,"context_line":"neutron-keepalived-state-change and neutron-ns-metadata-proxy."},{"line_number":11,"context_line":"In stead of adding individual filters to allow them to run from that"},{"line_number":12,"context_line":"directory, this patch adds /usr/local/bin into exec_dirs."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iade8b5b09bb53018485c85f8372fb94dbc2ad2da"},{"line_number":15,"context_line":"Closes-Bug: 1435971"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"bab921fb_2edebf6d","line":12,"in_reply_to":"bab921fb_4a0575c0","updated":"2015-04-23 13:36:17.000000000","message":"Ian, I think this is a list of PATHs in which you can find the executables that are required by the entries defined in individual filters (such as l3.filters). it\u0027s the filters that define what\u0027s allowed to be executed by root wrap.","commit_id":"617d0d4b76175478abc92fa2e7cdb33a7422761b"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"7d2fe2a57b02426ab14dae4b353abb07025b7665","unresolved":false,"context_lines":[{"line_number":10,"context_line":"neutron-keepalived-state-change and neutron-ns-metadata-proxy."},{"line_number":11,"context_line":"In stead of adding individual filters to allow them to run from that"},{"line_number":12,"context_line":"directory, this patch adds /usr/local/bin into exec_dirs."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iade8b5b09bb53018485c85f8372fb94dbc2ad2da"},{"line_number":15,"context_line":"Closes-Bug: 1435971"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"bab921fb_6abb990f","line":13,"updated":"2015-04-23 01:30:10.000000000","message":"can you please reference I3abd1c173121dc8abb5738d1879db8ac9a98b690 where there was discussion","commit_id":"617d0d4b76175478abc92fa2e7cdb33a7422761b"},{"author":{"_account_id":6685,"name":"Baodong (Robert) Li","email":"baoli@cisco.com","username":"baoli"},"change_message_id":"2728959b823e65de49370128ee8bba3fcb9eadb7","unresolved":false,"context_lines":[{"line_number":10,"context_line":"neutron-keepalived-state-change and neutron-ns-metadata-proxy."},{"line_number":11,"context_line":"In stead of adding individual filters to allow them to run from that"},{"line_number":12,"context_line":"directory, this patch adds /usr/local/bin into exec_dirs."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iade8b5b09bb53018485c85f8372fb94dbc2ad2da"},{"line_number":15,"context_line":"Closes-Bug: 1435971"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"bab921fb_cee4e33c","line":13,"in_reply_to":"bab921fb_6abb990f","updated":"2015-04-23 13:36:17.000000000","message":"Done","commit_id":"617d0d4b76175478abc92fa2e7cdb33a7422761b"}]}