)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"5750299b90088ebc72eb29b99a5c4783827d7359","unresolved":false,"context_lines":[{"line_number":16,"context_line":"1. set the privsep command line to use nova-rootwrap in nova.conf (and"},{"line_number":17,"context_line":"   similar in other configs), or"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"2. add the privsep-helper line to sudoers and bypass rootwrap entirely."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"This change implements (1) for devstack (nova only for now, cinder to"},{"line_number":22,"context_line":"follow shortly)."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3a57f1b5_a7e1799c","line":19,"updated":"2016-02-10 21:38:11.000000000","message":"Seems like we could be in a position to do this as well?  Can you motivate to me (fairly uneducated on this) why this is the right thing to do?","commit_id":"c81872365c640acb5338787cd424796f72285005"},{"author":{"_account_id":11279,"name":"Angus Lees","email":"gus@inodes.org","username":"gus"},"change_message_id":"40a796e27fde7dc6c5e55922918edfe1f1d4ba89","unresolved":false,"context_lines":[{"line_number":16,"context_line":"1. set the privsep command line to use nova-rootwrap in nova.conf (and"},{"line_number":17,"context_line":"   similar in other configs), or"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"2. add the privsep-helper line to sudoers and bypass rootwrap entirely."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"This change implements (1) for devstack (nova only for now, cinder to"},{"line_number":22,"context_line":"follow shortly)."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3a57f1b5_d471afa9","line":19,"in_reply_to":"3a57f1b5_a7e1799c","updated":"2016-02-11 05:46:22.000000000","message":"Yep, we could that instead - we just need to pick one.  I flipped a coin and decided (1) was slightly less objectionable since we already had lots of mechanism/precedent for setting nova.conf options.","commit_id":"c81872365c640acb5338787cd424796f72285005"}],"lib/nova":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5ea11f9de1d2e42433cda63df1b19d9e38d09c35","unresolved":false,"context_lines":[{"line_number":501,"context_line":"        iniset $NOVA_CONF DEFAULT bindir \"/usr/bin\""},{"line_number":502,"context_line":"    fi"},{"line_number":503,"context_line":""},{"line_number":504,"context_line":"    iniset $NOVA_CONF privsep_osbrick helper_command \"sudo nova-rootwrap \\$rootwrap_config privsep-helper --config-file $NOVA_CONF\""},{"line_number":505,"context_line":""},{"line_number":506,"context_line":"    if is_service_enabled n-api; then"},{"line_number":507,"context_line":"        if is_service_enabled n-api-meta; then"}],"source_content_type":"application/x-shellscript","patch_set":3,"id":"1af94dfe_ea4845ce","line":504,"range":{"start_line":504,"start_character":22,"end_line":504,"end_character":52},"updated":"2016-03-18 18:26:31.000000000","message":"Is there a nova change somewhere that defines this for the sample config docs?","commit_id":"58467e2102824e92655f448fd6cb55f8820a4cf7"},{"author":{"_account_id":11279,"name":"Angus Lees","email":"gus@inodes.org","username":"gus"},"change_message_id":"fe22cb70baf0c1280aa2896075036a138a4cefa5","unresolved":false,"context_lines":[{"line_number":501,"context_line":"        iniset $NOVA_CONF DEFAULT bindir \"/usr/bin\""},{"line_number":502,"context_line":"    fi"},{"line_number":503,"context_line":""},{"line_number":504,"context_line":"    iniset $NOVA_CONF privsep_osbrick helper_command \"sudo nova-rootwrap \\$rootwrap_config privsep-helper --config-file $NOVA_CONF\""},{"line_number":505,"context_line":""},{"line_number":506,"context_line":"    if is_service_enabled n-api; then"},{"line_number":507,"context_line":"        if is_service_enabled n-api-meta; then"}],"source_content_type":"application/x-shellscript","patch_set":3,"id":"fa0719c6_7ac16e2e","line":504,"range":{"start_line":504,"start_character":22,"end_line":504,"end_character":52},"in_reply_to":"1af94dfe_ea4845ce","updated":"2016-03-21 05:14:40.000000000","message":"No?  Tell me more about this nova \"sample config docs\"...\n\nI presume this involves etc/nova/nova-config-generator.conf?  How do I coordinate a change to this file when what I\u0027m adding is not a direct dependency of nova itself?  (or perhaps the config generator ignores import errors or somesuch?)","commit_id":"58467e2102824e92655f448fd6cb55f8820a4cf7"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7b53bea5ee3805a46566647100510127bc107ec2","unresolved":false,"context_lines":[{"line_number":501,"context_line":"        iniset $NOVA_CONF DEFAULT bindir \"/usr/bin\""},{"line_number":502,"context_line":"    fi"},{"line_number":503,"context_line":""},{"line_number":504,"context_line":"    iniset $NOVA_CONF privsep_osbrick helper_command \"sudo nova-rootwrap \\$rootwrap_config privsep-helper --config-file $NOVA_CONF\""},{"line_number":505,"context_line":""},{"line_number":506,"context_line":"    if is_service_enabled n-api; then"},{"line_number":507,"context_line":"        if is_service_enabled n-api-meta; then"}],"source_content_type":"application/x-shellscript","patch_set":3,"id":"fa0719c6_aab870e6","line":504,"range":{"start_line":504,"start_character":22,"end_line":504,"end_character":52},"in_reply_to":"fa0719c6_7ac16e2e","updated":"2016-03-22 19:05:36.000000000","message":"Right, whatever generates this:\n\nhttp://docs.openstack.org/developer/nova/sample_config.html\n\nSo I think we\u0027d need an oslo.privsep entry in https://github.com/openstack/nova/blob/master/etc/nova/nova-config-generator.conf so we can get right options to set, but I don\u0027t see privsep itself defining any config options, so that probably doesn\u0027t work.\n\nI guess this option is really defined in os-brick:\n\nhttps://review.openstack.org/#/c/277224/23/os_brick/privileged/__init__.py\n\nAnd the group has these options:\n\nhttps://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/priv_context.py#L48\n\nBut where is user and group set?\n\nhttps://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/priv_context.py#L40-L43\n\nI guess those are optional if you\u0027re using helper_command that\u0027s pointing at rootwrap?\n\nI\u0027m just really lost, obviously, at the order of things and how they tie together, as noted in the mailing list thread on these changes.","commit_id":"58467e2102824e92655f448fd6cb55f8820a4cf7"}]}