)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"df1d0e5f7c4f234e7ff0ae8ef5a19f941cb73bec","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"fc485de1_9ec1521e","updated":"2026-06-10 18:55:42.000000000","message":"recheck\nGeneric scenario with weird failures","commit_id":"765acaed2705fe9126684b7d4f8415e354bb3da8"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"11127d5950ba1d31f72cae6f07c210c23e593f59","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"ee609796_60a3413e","updated":"2026-08-06 00:00:05.000000000","message":"Thank you for the review. I added WIP to the commit message because I wanted to have CI testing and ensure things are working just fine. I made the changes and pushed, had some Claude code assistance and tried directing it into not introducing any regressions. I don\u0027t love some of the hardcoding going on, so I was doing some research and I just found a way to reuse this values that are already set in pyroute2. I\u0027ll make these hardcoded value changes for kernel values in the next patch.","commit_id":"d908331e88f1b420801996aadedb8f2de94d5959"}],"manila/network/linux/ip_lib.py":[{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"11127d5950ba1d31f72cae6f07c210c23e593f59","unresolved":true,"context_lines":[{"line_number":72,"context_line":"                retval.append(IPDevice(name, self.namespace))"},{"line_number":73,"context_line":"        return retval"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    def add_tuntap(self, name, mode\u003d\u0027tap\u0027):"},{"line_number":76,"context_line":"        self._as_root(\u0027\u0027, \u0027tuntap\u0027, (\u0027add\u0027, name, \u0027mode\u0027, mode))"},{"line_number":77,"context_line":"        return IPDevice(name, self.namespace)"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"a84f8cdc_7e887735","side":"PARENT","line":75,"range":{"start_line":75,"start_character":8,"end_line":75,"end_character":18},"updated":"2026-08-06 00:00:05.000000000","message":"this and a couple of other methods were removed because there was nothing calling them, other than their own tests.","commit_id":"a0c36c69929376c580f652b928599dda1b039afb"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"8b2a6c682d4299e041ed83884d96f0f2f4a27cff","unresolved":false,"context_lines":[{"line_number":72,"context_line":"                retval.append(IPDevice(name, self.namespace))"},{"line_number":73,"context_line":"        return retval"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    def add_tuntap(self, name, mode\u003d\u0027tap\u0027):"},{"line_number":76,"context_line":"        self._as_root(\u0027\u0027, \u0027tuntap\u0027, (\u0027add\u0027, name, \u0027mode\u0027, mode))"},{"line_number":77,"context_line":"        return IPDevice(name, self.namespace)"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"98fc487e_09003e76","side":"PARENT","line":75,"range":{"start_line":75,"start_character":8,"end_line":75,"end_character":18},"in_reply_to":"a84f8cdc_7e887735","updated":"2026-08-06 20:49:41.000000000","message":"Done","commit_id":"a0c36c69929376c580f652b928599dda1b039afb"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"11127d5950ba1d31f72cae6f07c210c23e593f59","unresolved":true,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"LOOPBACK_DEVNAME \u003d \u0027lo\u0027"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"SCOPE_NAME_TO_NUM \u003d {"},{"line_number":26,"context_line":"    \u0027global\u0027: 0,"},{"line_number":27,"context_line":"    \u0027universe\u0027: 0,"},{"line_number":28,"context_line":"    \u0027site\u0027: 200,"}],"source_content_type":"text/x-python","patch_set":5,"id":"ebdf7ed9_47485271","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":17},"updated":"2026-08-06 00:00:05.000000000","message":"these are kernel numeric defaults, I found a way to reuse it from pyroute2, will do that in the next PS","commit_id":"d908331e88f1b420801996aadedb8f2de94d5959"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"8b2a6c682d4299e041ed83884d96f0f2f4a27cff","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"LOOPBACK_DEVNAME \u003d \u0027lo\u0027"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"SCOPE_NAME_TO_NUM \u003d {"},{"line_number":26,"context_line":"    \u0027global\u0027: 0,"},{"line_number":27,"context_line":"    \u0027universe\u0027: 0,"},{"line_number":28,"context_line":"    \u0027site\u0027: 200,"}],"source_content_type":"text/x-python","patch_set":5,"id":"3c5f1063_0f36be3f","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":17},"in_reply_to":"ebdf7ed9_47485271","updated":"2026-08-06 20:49:41.000000000","message":"Done","commit_id":"d908331e88f1b420801996aadedb8f2de94d5959"}],"manila/privsep/networking.py":[{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"d9e296d487b882720385b1e01e6ba980400883d8","unresolved":true,"context_lines":[{"line_number":1,"context_line":"# Copyright 2021 Red Hat, Inc"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"#    not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":3,"id":"4e429810_519e9004","line":1,"range":{"start_line":1,"start_character":0,"end_line":1,"end_character":29},"updated":"2026-06-12 20:09:47.000000000","message":"2026","commit_id":"765acaed2705fe9126684b7d4f8415e354bb3da8"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"51708299f898a42f26f5d843c2ed3d652922cfbd","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2021 Red Hat, Inc"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"#    not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":3,"id":"c8bac821_edb11789","line":1,"range":{"start_line":1,"start_character":0,"end_line":1,"end_character":29},"in_reply_to":"4e429810_519e9004","updated":"2026-06-19 20:06:11.000000000","message":"Done","commit_id":"765acaed2705fe9126684b7d4f8415e354bb3da8"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"160ebb877828c195ffa7a83211f38bae4b5f0ff1","unresolved":true,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"@manila.privsep.sys_admin_pctxt.entrypoint"},{"line_number":24,"context_line":"def ip(*args, check_exit_code\u003dTrue):"},{"line_number":25,"context_line":"    \"\"\"Execute ip command with arbitrary arguments.\"\"\""},{"line_number":26,"context_line":"    return processutils.execute(\u0027ip\u0027, *args, check_exit_code\u003dcheck_exit_code)"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"5f3d2ff1_80880221","line":24,"updated":"2026-07-19 05:54:34.000000000","message":"This accepts arbitrary arguments and runs them as root. This is particularly dangerous because callers pass through `ip netns exec \u003cns\u003e \u003carbitrary command\u003e`, which effectively allows running any command as root.\n\nI think privsep\u0027s value is in constraining what can run as root. An `ip(*args)` entrypoint is no better than rootwrap\u0027s `CommandFilter, ip, root` — it\u0027s just a different mechanism for the same broad permission.\n\nNeutron\u0027s ip_lib.py (which Manila\u0027s was originally copied from) went through this same migration and replaced the CLI calls entirely with pyroute2 (Python netlink bindings), creating narrow privsep entrypoints — each constrained to one operation:\n\n- Commit replacing ip netns add/delete/list with pyroute2: https://opendev.org/openstack/neutron/commit/4f627b4e8dfe699944a196fe90e0642cced6278f\n- Commit replacing ip route with pyroute2: https://opendev.org/openstack/neutron/commit/06997136097152ea67611ec56b345e5867184df5\n- The tracking bug for the full effort: https://bugs.launchpad.net/neutron/+bug/1492714\n\nThe cleanest path forward would be to use pyroute2 as neutron does, or at minimum create narrow per-operation entrypoints (`ip_link_set_up`, `ip_addr_add`, `ip_netns_add`, `ip_netns_delete`, etc.) instead of a single catch-all.","commit_id":"310d7d83c6ec3c768bcb95f112a6276a908fa237"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"11127d5950ba1d31f72cae6f07c210c23e593f59","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"@manila.privsep.sys_admin_pctxt.entrypoint"},{"line_number":24,"context_line":"def ip(*args, check_exit_code\u003dTrue):"},{"line_number":25,"context_line":"    \"\"\"Execute ip command with arbitrary arguments.\"\"\""},{"line_number":26,"context_line":"    return processutils.execute(\u0027ip\u0027, *args, check_exit_code\u003dcheck_exit_code)"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"3f01144e_423fbbd3","line":24,"in_reply_to":"5f3d2ff1_80880221","updated":"2026-08-06 00:00:05.000000000","message":"I agree with you, we should re-evaluate our usage and reconsider how to implement this. I\u0027ve worked on re-implementing the commands to reuse pyroute2 (with some Claude assistance, which I\u0027ll mention in the commit message) - it follows a very similar approach compared to what the Neutron team did.","commit_id":"310d7d83c6ec3c768bcb95f112a6276a908fa237"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"160ebb877828c195ffa7a83211f38bae4b5f0ff1","unresolved":true,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"@manila.privsep.sys_admin_pctxt.entrypoint"},{"line_number":30,"context_line":"def ovs_vsctl(*args):"},{"line_number":31,"context_line":"    \"\"\"Execute ovs-vsctl command with arbitrary arguments.\"\"\""},{"line_number":32,"context_line":"    return processutils.execute(\u0027ovs-vsctl\u0027, *args)"}],"source_content_type":"text/x-python","patch_set":4,"id":"917a6755_648925db","line":30,"updated":"2026-07-19 05:54:34.000000000","message":"Same concern as `ip()` but less severe — `ovs-vsctl` is more constrained in what it can do. Still worth narrowing to specific operations like `ovs_add_port(bridge, port, ...)`, `ovs_del_port(bridge, port)`, `ovs_del_br(bridge)`, `ovs_add_br(bridge)`.","commit_id":"310d7d83c6ec3c768bcb95f112a6276a908fa237"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"11127d5950ba1d31f72cae6f07c210c23e593f59","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"@manila.privsep.sys_admin_pctxt.entrypoint"},{"line_number":30,"context_line":"def ovs_vsctl(*args):"},{"line_number":31,"context_line":"    \"\"\"Execute ovs-vsctl command with arbitrary arguments.\"\"\""},{"line_number":32,"context_line":"    return processutils.execute(\u0027ovs-vsctl\u0027, *args)"}],"source_content_type":"text/x-python","patch_set":4,"id":"96322e39_d9db17a1","line":30,"in_reply_to":"917a6755_648925db","updated":"2026-08-06 00:00:05.000000000","message":"Done","commit_id":"310d7d83c6ec3c768bcb95f112a6276a908fa237"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"11127d5950ba1d31f72cae6f07c210c23e593f59","unresolved":true,"context_lines":[{"line_number":34,"context_line":"def _get_link_index(ip, device_name):"},{"line_number":35,"context_line":"    indices \u003d ip.link_lookup(ifname\u003ddevice_name)"},{"line_number":36,"context_line":"    if not indices:"},{"line_number":37,"context_line":"        raise RuntimeError("},{"line_number":38,"context_line":"            \"Network device %r does not exist\" % device_name)"},{"line_number":39,"context_line":"    return indices[0]"},{"line_number":40,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"c8f60edc_77b14181","line":37,"range":{"start_line":37,"start_character":14,"end_line":37,"end_character":26},"updated":"2026-08-06 00:00:05.000000000","message":"Let\u0027s be more specific here","commit_id":"d908331e88f1b420801996aadedb8f2de94d5959"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"8b2a6c682d4299e041ed83884d96f0f2f4a27cff","unresolved":true,"context_lines":[{"line_number":34,"context_line":"def _get_link_index(ip, device_name):"},{"line_number":35,"context_line":"    indices \u003d ip.link_lookup(ifname\u003ddevice_name)"},{"line_number":36,"context_line":"    if not indices:"},{"line_number":37,"context_line":"        raise RuntimeError("},{"line_number":38,"context_line":"            \"Network device %r does not exist\" % device_name)"},{"line_number":39,"context_line":"    return indices[0]"},{"line_number":40,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"256dd5d4_02c26cd3","line":37,"range":{"start_line":37,"start_character":14,"end_line":37,"end_character":26},"in_reply_to":"c8f60edc_77b14181","updated":"2026-08-06 20:49:41.000000000","message":"argh, forgot about this :)","commit_id":"d908331e88f1b420801996aadedb8f2de94d5959"},{"author":{"_account_id":29632,"name":"Carlos Eduardo","email":"ces.eduardo98@gmail.com","username":"silvacarlos"},"change_message_id":"11127d5950ba1d31f72cae6f07c210c23e593f59","unresolved":true,"context_lines":[{"line_number":90,"context_line":"@manila.privsep.sys_admin_pctxt.entrypoint"},{"line_number":91,"context_line":"def link_list_devices(namespace\u003dNone):"},{"line_number":92,"context_line":"    \"\"\"Returns list of dicts with ifname, index, address, flags.\"\"\""},{"line_number":93,"context_line":"    with _get_iproute(namespace) as ip:"},{"line_number":94,"context_line":"        result \u003d []"},{"line_number":95,"context_line":"        for link in ip.get_links():"},{"line_number":96,"context_line":"            result.append({"}],"source_content_type":"text/x-python","patch_set":5,"id":"626485f6_55cccadd","line":93,"range":{"start_line":93,"start_character":4,"end_line":93,"end_character":39},"updated":"2026-08-06 00:00:05.000000000","message":"I am not a strong fan of the context manager, but it seems to be the pattern used by the neutron team and other places that implement pyroute2 as an approach for IPRoute + other capabilities.","commit_id":"d908331e88f1b420801996aadedb8f2de94d5959"}]}