)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":13,"context_line":"reachable from vms."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"This change allows to change neutron-ns-metadata-proxy permissions"},{"line_number":16,"context_line":"after its startup through the 2 new option metadata_user and"},{"line_number":17,"context_line":"metadata_group which allow to define user/group running metadata"},{"line_number":18,"context_line":"proxy after its initialization (by default: nobody user/group)."},{"line_number":19,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_f4457a70","line":16,"updated":"2014-12-10 17:35:45.000000000","message":"nit: option -\u003e options","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":13,"context_line":"reachable from vms."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"This change allows to change neutron-ns-metadata-proxy permissions"},{"line_number":16,"context_line":"after its startup through the 2 new option metadata_user and"},{"line_number":17,"context_line":"metadata_group which allow to define user/group running metadata"},{"line_number":18,"context_line":"proxy after its initialization (by default: nobody user/group)."},{"line_number":19,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_153bddd1","line":16,"in_reply_to":"3a961159_f4457a70","updated":"2014-12-10 18:45:56.000000000","message":"Done","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":17,"context_line":"metadata_group which allow to define user/group running metadata"},{"line_number":18,"context_line":"proxy after its initialization (by default: nobody user/group)."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Root permissions are dropped by neutron-ns-metadata-proxy after the"},{"line_number":21,"context_line":"daemon initialization otherwise the daemon cannot write its pid in the"},{"line_number":22,"context_line":"pidfile."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_cf2aab7d","line":20,"updated":"2014-12-10 17:35:45.000000000","message":"If I\u0027m running a process as root, it\u0027s supposed to have permissions for every file on the filesystem, so I\u0027m not clear on the meaning behind this paragraph.","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"553c635be338cb7450cf007003e329e9b2988623","unresolved":false,"context_lines":[{"line_number":17,"context_line":"metadata_group which allow to define user/group running metadata"},{"line_number":18,"context_line":"proxy after its initialization (by default: nobody user/group)."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Root permissions are dropped by neutron-ns-metadata-proxy after the"},{"line_number":21,"context_line":"daemon initialization otherwise the daemon cannot write its pid in the"},{"line_number":22,"context_line":"pidfile."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_7704104a","line":20,"in_reply_to":"3a961159_6d760ad9","updated":"2014-12-11 12:38:22.000000000","message":"Done","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":17,"context_line":"metadata_group which allow to define user/group running metadata"},{"line_number":18,"context_line":"proxy after its initialization (by default: nobody user/group)."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Root permissions are dropped by neutron-ns-metadata-proxy after the"},{"line_number":21,"context_line":"daemon initialization otherwise the daemon cannot write its pid in the"},{"line_number":22,"context_line":"pidfile."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_d5279562","line":20,"in_reply_to":"3a961159_cf2aab7d","updated":"2014-12-10 18:45:56.000000000","message":"not after permissions drop","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"fbf98894f9b9af5e7e20186daf63094503d5d1f7","unresolved":false,"context_lines":[{"line_number":17,"context_line":"metadata_group which allow to define user/group running metadata"},{"line_number":18,"context_line":"proxy after its initialization (by default: nobody user/group)."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Root permissions are dropped by neutron-ns-metadata-proxy after the"},{"line_number":21,"context_line":"daemon initialization otherwise the daemon cannot write its pid in the"},{"line_number":22,"context_line":"pidfile."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_6d760ad9","line":20,"in_reply_to":"3a961159_d5279562","updated":"2014-12-11 07:48:20.000000000","message":"Exactly, so the \"otherwise\" part of this sentence doesn\u0027t make sense in this context.","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":31,"context_line":"a client request the metada proxy."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"TODO:"},{"line_number":34,"context_line":"* Choose the right default metadata user/group (root/neutron/nobody?)"},{"line_number":35,"context_line":"* Handle socket limitations:"},{"line_number":36,"context_line":" * Could we allow a metadata socket with o666 permissions?"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_af4e3f6d","line":34,"updated":"2014-12-10 17:35:45.000000000","message":"To be determined by the euid the running process (l3_agent?) is using?","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"fbf98894f9b9af5e7e20186daf63094503d5d1f7","unresolved":false,"context_lines":[{"line_number":31,"context_line":"a client request the metada proxy."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"TODO:"},{"line_number":34,"context_line":"* Choose the right default metadata user/group (root/neutron/nobody?)"},{"line_number":35,"context_line":"* Handle socket limitations:"},{"line_number":36,"context_line":" * Could we allow a metadata socket with o666 permissions?"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_ad2ab28d","line":34,"in_reply_to":"3a961159_550485bf","updated":"2014-12-11 07:48:20.000000000","message":"I meant, the right default user/group seems to me like the one the neutron/euid is using.","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":31,"context_line":"a client request the metada proxy."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"TODO:"},{"line_number":34,"context_line":"* Choose the right default metadata user/group (root/neutron/nobody?)"},{"line_number":35,"context_line":"* Handle socket limitations:"},{"line_number":36,"context_line":" * Could we allow a metadata socket with o666 permissions?"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_550485bf","line":34,"in_reply_to":"3a961159_af4e3f6d","updated":"2014-12-10 18:45:56.000000000","message":"* root is the conservative option\n* neutron/euid is safer than root but the metadata proxy still have neutron-rootwrap permissions (sick)\n* nobody is the safer option but implies to address permission troubles to connect to the metadata socket","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":33,"context_line":"TODO:"},{"line_number":34,"context_line":"* Choose the right default metadata user/group (root/neutron/nobody?)"},{"line_number":35,"context_line":"* Handle socket limitations:"},{"line_number":36,"context_line":" * Could we allow a metadata socket with o666 permissions?"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"DocImpact"},{"line_number":39,"context_line":"Partial-Bug: #1187107"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_4f3ddbba","line":36,"updated":"2014-12-10 17:35:45.000000000","message":"Intuition says this will disallow write() to the socket, but I didn\u0027t check this at all.","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":33,"context_line":"TODO:"},{"line_number":34,"context_line":"* Choose the right default metadata user/group (root/neutron/nobody?)"},{"line_number":35,"context_line":"* Handle socket limitations:"},{"line_number":36,"context_line":" * Could we allow a metadata socket with o666 permissions?"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"DocImpact"},{"line_number":39,"context_line":"Partial-Bug: #1187107"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_d52155a0","line":36,"in_reply_to":"3a961159_4f3ddbba","updated":"2014-12-10 18:45:56.000000000","message":"6 \u003d\u003d read(4) + write(2)","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"fbf98894f9b9af5e7e20186daf63094503d5d1f7","unresolved":false,"context_lines":[{"line_number":33,"context_line":"TODO:"},{"line_number":34,"context_line":"* Choose the right default metadata user/group (root/neutron/nobody?)"},{"line_number":35,"context_line":"* Handle socket limitations:"},{"line_number":36,"context_line":" * Could we allow a metadata socket with o666 permissions?"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"DocImpact"},{"line_number":39,"context_line":"Partial-Bug: #1187107"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"3a961159_2d488286","line":36,"in_reply_to":"3a961159_d52155a0","updated":"2014-12-11 07:48:20.000000000","message":"You\u0027re right. Sorry :)","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"}],"etc/l3_agent.ini":[{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":48,"context_line":"# TCP Port used by Neutron metadata server"},{"line_number":49,"context_line":"# metadata_port \u003d 9697"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"# User (uid or name) running metadata proxy after its initialization"},{"line_number":52,"context_line":"# metadata_user \u003d 65534"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"# Group (gid or name) running metadata proxy after its initialization"}],"source_content_type":"text/x-properties","patch_set":14,"id":"3a961159_2f4c0f42","line":51,"updated":"2014-12-10 17:35:45.000000000","message":"Worth mentioning that the default values here mean \u0027nobody\u0027 (and \u0027nogroup\u0027 later on)","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":48,"context_line":"# TCP Port used by Neutron metadata server"},{"line_number":49,"context_line":"# metadata_port \u003d 9697"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"# User (uid or name) running metadata proxy after its initialization"},{"line_number":52,"context_line":"# metadata_user \u003d 65534"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"# Group (gid or name) running metadata proxy after its initialization"}],"source_content_type":"text/x-properties","patch_set":14,"id":"3a961159_551ba51a","line":51,"in_reply_to":"3a961159_2f4c0f42","updated":"2014-12-10 18:45:56.000000000","message":"Done","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"b876119e52304e828001e72f73f9225885d07fbb","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"# User (uid or name) running metadata proxy after its initialization"},{"line_number":52,"context_line":"# (default: nobody uid)"},{"line_number":53,"context_line":"# metadata_user \u003d 65534"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"# Group (gid or name) running metadata proxy after its initialization"},{"line_number":56,"context_line":"# (default: nogroup gid)"}],"source_content_type":"text/x-properties","patch_set":18,"id":"3a961159_3a0b447e","line":53,"updated":"2014-12-12 16:52:52.000000000","message":"Why not symbolic versions? I don\u0027t think every platform has the same numbers for the user and the group.\n\nAlso, maybe renaming both options to medata_proxy_[user|group] would be better for being more explicit.","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"66505c51f70dd045cd86e41f07c659ccc085f64e","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"# User (uid or name) running metadata proxy after its initialization"},{"line_number":52,"context_line":"# (default: nobody uid)"},{"line_number":53,"context_line":"# metadata_user \u003d 65534"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"# Group (gid or name) running metadata proxy after its initialization"},{"line_number":56,"context_line":"# (default: nogroup gid)"}],"source_content_type":"text/x-properties","patch_set":18,"id":"3a961159_31f33f0b","line":53,"in_reply_to":"3a961159_3a0b447e","updated":"2014-12-12 17:34:27.000000000","message":"I am not sure which one is \"standard\" ... the gid/uid (65534) or names (nobody/nogroup). iirc, centos5 unprivileged user/group was nfsnobody(65534).\n\nFine for using metadata_proxy_user/group\n\nAccording to next comments, i should use as default uid/gid, neutron-l3-agent euid/egid","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":49,"context_line":"# metadata_port \u003d 9697"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"# User (uid or name) running metadata proxy after its initialization"},{"line_number":52,"context_line":"# (default: l3-agent effective user, if empty: l3_agent effective user)"},{"line_number":53,"context_line":"# metadata_proxy_user \u003d"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"# Group (gid or name) running metadata proxy after its initialization"}],"source_content_type":"text/x-properties","patch_set":22,"id":"3a961159_60051e10","line":52,"updated":"2014-12-19 19:38:29.000000000","message":"(No action required)\n\nnit: looks like there is some duplication here and below that can be reduced:\n\n# User (uid or name) running metadata proxy after its initialization (if empty, L3 agent effective user)\n# (default: \u003cempty\u003e)","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":49,"context_line":"# metadata_port \u003d 9697"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"# User (uid or name) running metadata proxy after its initialization"},{"line_number":52,"context_line":"# (default: l3-agent effective user, if empty: l3_agent effective user)"},{"line_number":53,"context_line":"# metadata_proxy_user \u003d"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"# Group (gid or name) running metadata proxy after its initialization"}],"source_content_type":"text/x-properties","patch_set":22,"id":"3a961159_1bcf5980","line":52,"in_reply_to":"3a961159_60051e10","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"}],"etc/neutron/rootwrap.d/l3.filters":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"766fb071df72853946a006d38d927f4387eb38da","unresolved":false,"context_lines":[{"line_number":31,"context_line":"# ip_lib"},{"line_number":32,"context_line":"ip: IpFilter, ip, root"},{"line_number":33,"context_line":"ip_exec: IpNetnsExecFilter, ip, root"},{"line_number":34,"context_line":"ip_user_exec: ChainingRegExpFilter, ip, root, ip, netns, exec, .*, sudo, -u, .*"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"# ovs_lib (if OVSInterfaceDriver is used)"},{"line_number":37,"context_line":"ovs-vsctl: CommandFilter, ovs-vsctl, root"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"5a890539_4eb75821","line":34,"updated":"2014-12-03 16:53:39.000000000","message":"So just so it\u0027s clear (to me) since even after reading the comment on ChainingRegExpFilter things still seem fuzzy.  Are the \u0027.*\u0027 here allowing any command or are things checked by other filters?  The first one obviously has to be a namespace, but the second could be anything.  Just don\u0027t want to open some obscure security hole here.","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"cad447c2acc76f5114cb29a5cd2fde0ab2fcf950","unresolved":false,"context_lines":[{"line_number":31,"context_line":"# ip_lib"},{"line_number":32,"context_line":"ip: IpFilter, ip, root"},{"line_number":33,"context_line":"ip_exec: IpNetnsExecFilter, ip, root"},{"line_number":34,"context_line":"ip_user_exec: ChainingRegExpFilter, ip, root, ip, netns, exec, .*, sudo, -u, .*"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"# ovs_lib (if OVSInterfaceDriver is used)"},{"line_number":37,"context_line":"ovs-vsctl: CommandFilter, ovs-vsctl, root"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"5a890539_8c522811","line":34,"in_reply_to":"5a890539_11f57582","updated":"2014-12-03 17:24:12.000000000","message":"Thanks for the explanation, that should be over in the oslo comment :)","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"7717f53490bc7ef7fa67e12e041a871e6f27df50","unresolved":false,"context_lines":[{"line_number":31,"context_line":"# ip_lib"},{"line_number":32,"context_line":"ip: IpFilter, ip, root"},{"line_number":33,"context_line":"ip_exec: IpNetnsExecFilter, ip, root"},{"line_number":34,"context_line":"ip_user_exec: ChainingRegExpFilter, ip, root, ip, netns, exec, .*, sudo, -u, .*"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"# ovs_lib (if OVSInterfaceDriver is used)"},{"line_number":37,"context_line":"ovs-vsctl: CommandFilter, ovs-vsctl, root"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"5a890539_11f57582","line":34,"in_reply_to":"5a890539_4eb75821","updated":"2014-12-03 17:17:59.000000000","message":"rootwrap filters is a littlle bit tricky to understand, even more when using chaining filters like IpNetnsExecFilter and ChainingRegExpFilter.\n\nIndeed .* allows a wildcard attribute (only one). As you said the 1st wildcard is for namespace name, the 2nd one is for the user name because we don\u0027t know the name of the effective user running neutron: it could be neutron in ubuntu, stack in gate (if i remember correctly) ...\n\nAt first it look unsafe to allow such wildcard but if we transform ip_exec filter (L33) in a ChainingRegExpFilter filter it becomes:\n\n  ip_exec: ChainingRegExpFilter, ip, root, ip, netns, exec, .*\n\nip_exec filter allows to run commands as root in a namespace and the command suffix must match an other filter:\n\n # (sudo neutron-rootwrap /etc/neutron/rootwrap.conf) \n ip netns exec $namespace neutron-ns-metadata-proxy ...\n # accepted because\n # ip netns exec $namespace matchs ip_exec filter \n # neutron-ns-metadata-proxy matchs metadata_proxy filter\n\nip_user_exec allows to run commands not as root in a namespace and the command suffix must match an other filter:\n\n # (sudo neutron-rootwrap /etc/neutron/rootwrap.conf)\n ip netns exec $namespace sudo -u $euid neutron-ns-metadata-proxy ...\n # accepted because\n # ip netns exec $namespace sudo -u $euid matchs ip_user_exec filter \n # neutron-ns-metadata-proxy matchs metadata_proxy filter\n\n\nTo summarize:\n* ip_exec allows to run as root in namespace\n* ip_user_exec allows to run as non-root in namespace","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"}],"neutron/agent/l3/agent.py":[{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"18f6a3b7296d54c4f5477343e25a7cd53d63fbc7","unresolved":false,"context_lines":[{"line_number":511,"context_line":"        del self.router_info[router_id]"},{"line_number":512,"context_line":"        self._destroy_router_namespace(ri.ns_name)"},{"line_number":513,"context_line":""},{"line_number":514,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":515,"context_line":"        if self.conf.metadata_proxy_user \u003d\u003d \u0027\u0027:"},{"line_number":516,"context_line":"            user \u003d os.geteuid()"},{"line_number":517,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_c739e8d9","line":514,"updated":"2014-12-17 09:01:59.000000000","message":"How about this one?\n\n user \u003d self.conf.metadata_proxy_user or os.geteuid()\n group \u003d self.conf.metadata_proxy_group or os.getegid()\n return user, group","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":511,"context_line":"        del self.router_info[router_id]"},{"line_number":512,"context_line":"        self._destroy_router_namespace(ri.ns_name)"},{"line_number":513,"context_line":""},{"line_number":514,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":515,"context_line":"        if self.conf.metadata_proxy_user \u003d\u003d \u0027\u0027:"},{"line_number":516,"context_line":"            user \u003d os.geteuid()"},{"line_number":517,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_7bc21d54","line":514,"in_reply_to":"3a961159_20179646","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":511,"context_line":"        del self.router_info[router_id]"},{"line_number":512,"context_line":"        self._destroy_router_namespace(ri.ns_name)"},{"line_number":513,"context_line":""},{"line_number":514,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":515,"context_line":"        if self.conf.metadata_proxy_user \u003d\u003d \u0027\u0027:"},{"line_number":516,"context_line":"            user \u003d os.geteuid()"},{"line_number":517,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_20179646","line":514,"in_reply_to":"3a961159_4aa17fa8","updated":"2014-12-19 19:38:29.000000000","message":"\u00270\u0027 string is still True in boolean context.\n+1 to John\u0027s suggestion.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"1f3c73a8687eeb226ee33533a6499bcfcb4ad5fd","unresolved":false,"context_lines":[{"line_number":511,"context_line":"        del self.router_info[router_id]"},{"line_number":512,"context_line":"        self._destroy_router_namespace(ri.ns_name)"},{"line_number":513,"context_line":""},{"line_number":514,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":515,"context_line":"        if self.conf.metadata_proxy_user \u003d\u003d \u0027\u0027:"},{"line_number":516,"context_line":"            user \u003d os.geteuid()"},{"line_number":517,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_4aa17fa8","line":514,"in_reply_to":"3a961159_c739e8d9","updated":"2014-12-17 12:35:17.000000000","message":"it does not support 0 uid/gid","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"a3af574cd5500895dc960c24ca0b603eaad36788","unresolved":false,"context_lines":[{"line_number":523,"context_line":"            adv_svc.AdvancedService.after_router_removed, ri)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":526,"context_line":"        user \u003d self.conf.metadata_proxy_user or os.geteuid()"},{"line_number":527,"context_line":"        group \u003d self.conf.metadata_proxy_group or os.getegid()"},{"line_number":528,"context_line":"        return user, group"},{"line_number":529,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_aa1df810","line":526,"updated":"2014-12-22 23:09:57.000000000","message":"nit: I think it would be slightly better to move os.geteuid/getegid to the default option in StrOpt() above.","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"dac4d428662aacff9080bf513c9cea4fd0a60f9f","unresolved":false,"context_lines":[{"line_number":523,"context_line":"            adv_svc.AdvancedService.after_router_removed, ri)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":526,"context_line":"        user \u003d self.conf.metadata_proxy_user or os.geteuid()"},{"line_number":527,"context_line":"        group \u003d self.conf.metadata_proxy_group or os.getegid()"},{"line_number":528,"context_line":"        return user, group"},{"line_number":529,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_7bb2f949","line":526,"in_reply_to":"3a961159_002264a2","updated":"2014-12-23 16:56:33.000000000","message":"@Aaron, it would be clearer but metadata_proxy_user/group default values would be euid/egid during module load instead of current euid/egid.","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"eff4739327f26c1ceeea25697cabd0823c3df4ec","unresolved":false,"context_lines":[{"line_number":523,"context_line":"            adv_svc.AdvancedService.after_router_removed, ri)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":526,"context_line":"        user \u003d self.conf.metadata_proxy_user or os.geteuid()"},{"line_number":527,"context_line":"        group \u003d self.conf.metadata_proxy_group or os.getegid()"},{"line_number":528,"context_line":"        return user, group"},{"line_number":529,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_fb97a242","line":526,"in_reply_to":"3a961159_75091394","updated":"2014-12-24 17:30:18.000000000","message":"gotcha thanks.","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"cd893f186edc77d57a169fde2d4d74e789eaf2be","unresolved":false,"context_lines":[{"line_number":523,"context_line":"            adv_svc.AdvancedService.after_router_removed, ri)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":526,"context_line":"        user \u003d self.conf.metadata_proxy_user or os.geteuid()"},{"line_number":527,"context_line":"        group \u003d self.conf.metadata_proxy_group or os.getegid()"},{"line_number":528,"context_line":"        return user, group"},{"line_number":529,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_de0d9190","line":526,"in_reply_to":"3a961159_7bb2f949","updated":"2014-12-23 17:54:58.000000000","message":"@cedric, Why is that? I guess the metadata proxy fires up as a different user then it runs as?","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"46ff171eb4d6f9628cf1f4e94486891264a62ebc","unresolved":false,"context_lines":[{"line_number":523,"context_line":"            adv_svc.AdvancedService.after_router_removed, ri)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":526,"context_line":"        user \u003d self.conf.metadata_proxy_user or os.geteuid()"},{"line_number":527,"context_line":"        group \u003d self.conf.metadata_proxy_group or os.getegid()"},{"line_number":528,"context_line":"        return user, group"},{"line_number":529,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_002264a2","line":526,"in_reply_to":"3a961159_aa1df810","updated":"2014-12-23 09:41:32.000000000","message":"@Aaron, what about configuration generator that should eventually replace our git-managed configuration files? It will mean that default value generated for those config files will depend on the user who ran config generator, which is wrong.","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"b66b5afa4c8f0b1ed387729162c68e0ec733d913","unresolved":false,"context_lines":[{"line_number":523,"context_line":"            adv_svc.AdvancedService.after_router_removed, ri)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"    def _get_metadata_proxy_user_group(self):"},{"line_number":526,"context_line":"        user \u003d self.conf.metadata_proxy_user or os.geteuid()"},{"line_number":527,"context_line":"        group \u003d self.conf.metadata_proxy_group or os.getegid()"},{"line_number":528,"context_line":"        return user, group"},{"line_number":529,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_75091394","line":526,"in_reply_to":"3a961159_de0d9190","updated":"2014-12-23 22:59:01.000000000","message":"@Aaron, yes that\u0027s exactly :) the purpose of the change.\n\nCurrently we don\u0027t really care when L3 agent computes user/group for metadata proxies because L3 agent euid/egid are never changed. But [1] is a base to allow such euid/egid change ... it\u0027s better if L3 agent computes them at the right time (during runtime instead of during initialization).\n\n[1] https://review.openstack.org/128258","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"}],"neutron/agent/l3_agent.py":[{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"5c642f1a6f100f325c8c7604b0d03913e35d89c7","unresolved":false,"context_lines":[{"line_number":797,"context_line":"                         \u0027--state_path\u003d%s\u0027 % self.conf.state_path,"},{"line_number":798,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":799,"context_line":"            if self.conf.use_namespaces:"},{"line_number":800,"context_line":"                # run metadata_proxy with root permissions"},{"line_number":801,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, \u0027#%d\u0027 % os.geteuid()]"},{"line_number":802,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":803,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_d47aedb8","line":800,"updated":"2014-11-25 11:21:29.000000000","message":"s/with/without/g","commit_id":"d95625bb2b860a7f6530b727b150fe64da645036"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"80822d14f4a4014facfa30ae561dd4c6a02a4fce","unresolved":false,"context_lines":[{"line_number":797,"context_line":"                         \u0027--state_path\u003d%s\u0027 % self.conf.state_path,"},{"line_number":798,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":799,"context_line":"            if self.conf.use_namespaces:"},{"line_number":800,"context_line":"                # run metadata_proxy with root permissions"},{"line_number":801,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, \u0027#%d\u0027 % os.geteuid()]"},{"line_number":802,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":803,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_52828dc8","line":800,"in_reply_to":"5a890539_d47aedb8","updated":"2014-11-25 12:18:58.000000000","message":"oups\n\nDone","commit_id":"d95625bb2b860a7f6530b727b150fe64da645036"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"818c90dab45a4624b271d156e36d71dcacb272b0","unresolved":false,"context_lines":[{"line_number":798,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":799,"context_line":"            if self.conf.use_namespaces:"},{"line_number":800,"context_line":"                # run metadata_proxy without root permissions"},{"line_number":801,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, \u0027#%d\u0027 % os.geteuid()]"},{"line_number":802,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":803,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"},{"line_number":804,"context_line":"                router_id))"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_37f75cd6","line":801,"updated":"2014-11-27 14:41:03.000000000","message":"in ha mode, keepalived notify_master.sh tries to run:\n\n  sudo -u #1234 ...\n\nwhich fails because #1234 is considered as the beginning of a comment","commit_id":"37816086722293a324a6069169e1254da20dfd1f"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"aac2b72f9c1a263b9caab20b673700e3da0bc287","unresolved":false,"context_lines":[{"line_number":799,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":800,"context_line":"            if self.conf.use_namespaces:"},{"line_number":801,"context_line":"                # run metadata_proxy without root permissions"},{"line_number":802,"context_line":"                effective_username \u003d pwd.getpwuid(os.geteuid()).pw_name"},{"line_number":803,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, effective_username]"},{"line_number":804,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":805,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a890539_55baa0e1","line":802,"updated":"2014-12-03 09:28:21.000000000","message":"How about we use \u0027getpass.getuser()\u0027 instead? This seems like a much more straightforward way to retrieve the current user.","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"04a2d4ca6c4bcfba1fe3727359b8be93082acd38","unresolved":false,"context_lines":[{"line_number":799,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":800,"context_line":"            if self.conf.use_namespaces:"},{"line_number":801,"context_line":"                # run metadata_proxy without root permissions"},{"line_number":802,"context_line":"                effective_username \u003d pwd.getpwuid(os.geteuid()).pw_name"},{"line_number":803,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, effective_username]"},{"line_number":804,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":805,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a890539_35833804","line":802,"in_reply_to":"5a890539_1b54c720","updated":"2014-12-03 18:50:12.000000000","message":"and to read/write to the metadata socket","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"cf2d09051aa576a7e392a3083acef02ddf810a5e","unresolved":false,"context_lines":[{"line_number":799,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":800,"context_line":"            if self.conf.use_namespaces:"},{"line_number":801,"context_line":"                # run metadata_proxy without root permissions"},{"line_number":802,"context_line":"                effective_username \u003d pwd.getpwuid(os.geteuid()).pw_name"},{"line_number":803,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, effective_username]"},{"line_number":804,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":805,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a890539_d0e69e15","line":802,"in_reply_to":"5a890539_55baa0e1","updated":"2014-12-03 09:57:47.000000000","message":"getuser returns the current user not the effective user.\n\nThe effective user is the one checked when you do something that requires special access (sudo right for example). current user is not used to check permissions. The typical example is passwd which can be call by users but uses root id as euid to update system password file.\n\nSo we should use the effective user.","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"af6cd1b3c2922a08b55885b3aa69065f3d721dce","unresolved":false,"context_lines":[{"line_number":799,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":800,"context_line":"            if self.conf.use_namespaces:"},{"line_number":801,"context_line":"                # run metadata_proxy without root permissions"},{"line_number":802,"context_line":"                effective_username \u003d pwd.getpwuid(os.geteuid()).pw_name"},{"line_number":803,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, effective_username]"},{"line_number":804,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":805,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a890539_3b7a63ba","line":802,"in_reply_to":"5a890539_5b880f22","updated":"2014-12-03 10:42:36.000000000","message":"Discussed this with Cedric further in IRC and I\u0027m removing my objection as the euid is used to check permissions of files (specifically /var/log/neutron), so we want to run the process in the same id as our euid.\n\nNit: I think the comment in L801 can be changed (as the euid can be \u0027root\u0027 after all, meaning that the permission is not decreased after all). How about \"Try to run metadata_proxy without root permissions\"?\n\nAlso, I\u0027d add a comment about *why* we want to use euid, so it\u0027s clear for whoever reads the code. This is a nice-to-have.","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"c5cca1ece002874d9817bff21157e4f1afda3700","unresolved":false,"context_lines":[{"line_number":799,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":800,"context_line":"            if self.conf.use_namespaces:"},{"line_number":801,"context_line":"                # run metadata_proxy without root permissions"},{"line_number":802,"context_line":"                effective_username \u003d pwd.getpwuid(os.geteuid()).pw_name"},{"line_number":803,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, effective_username]"},{"line_number":804,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":805,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a890539_1b54c720","line":802,"in_reply_to":"5a890539_5b880f22","updated":"2014-12-03 10:42:55.000000000","message":"neutron rights is required by the metadata proxy for logging purpose in /var/log/neutron.","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"84e6c38818933d390e1ae240ac23ac377c2fa462","unresolved":false,"context_lines":[{"line_number":799,"context_line":"                         \u0027--metadata_port\u003d%s\u0027 % self.conf.metadata_port]"},{"line_number":800,"context_line":"            if self.conf.use_namespaces:"},{"line_number":801,"context_line":"                # run metadata_proxy without root permissions"},{"line_number":802,"context_line":"                effective_username \u003d pwd.getpwuid(os.geteuid()).pw_name"},{"line_number":803,"context_line":"                proxy_cmd[:0] \u003d [\u0027sudo\u0027, \u0027-u\u0027, effective_username]"},{"line_number":804,"context_line":"            proxy_cmd.extend(config.get_log_args("},{"line_number":805,"context_line":"                self.conf, \u0027neutron-ns-metadata-proxy-%s.log\u0027 %"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a890539_5b880f22","line":802,"in_reply_to":"5a890539_d0e69e15","updated":"2014-12-03 10:27:49.000000000","message":"The way I see it, the purpose of this patch is to run the metadata proxy without special permissions, so the euid can be safely ignored - and we actually want to decrease permissions, not increase it, so we\u0027re clear here\n\nAfaik the metadata proxy merely sets up a port forwarding (with port number \u003e 1024), so there shouldn\u0027t be any need for elevated user permission used. If it does need root access, it uses rootwrap (which should work regardless of the euid, or something else is severely broken).\n\nLastly, normal working operation shouldn\u0027t have a different euid for Neutron processes (and if we\u0027re running as root, the metadata proxy will be spawned as root anyway) - am I right in assuming this?\n\nI may be missing something here though - do we have a specific use for the euid here?","commit_id":"008210b32e30c045dbc2381ccc71c18d846f9c7c"}],"neutron/agent/linux/daemon.py":[{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"b876119e52304e828001e72f73f9225885d07fbb","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    \"\"\""},{"line_number":54,"context_line":"    log_root \u003d logging.getLogger(None).logger"},{"line_number":55,"context_line":"    to_replace \u003d [h for h in log_root.handlers"},{"line_number":56,"context_line":"                  if isinstance(h, handlers.WatchedFileHandler)]"},{"line_number":57,"context_line":"    for handler in to_replace:"},{"line_number":58,"context_line":"        new_handler \u003d std_logging.FileHandler(handler.baseFilename,"},{"line_number":59,"context_line":"                                              mode\u003dhandler.mode,"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_fb1b587e","line":56,"updated":"2014-12-12 16:52:52.000000000","message":"It\u0027s quite controvercial, and I don\u0027t think we can drop the feature without reaching to operators and community. I would say, let\u0027s implement the patch to allow to run proxy process as a user that has enough permissions to reopen the file (f.e. neutron), and then see how we can restrict permissions even more (till nobody).","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"66505c51f70dd045cd86e41f07c659ccc085f64e","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    \"\"\""},{"line_number":54,"context_line":"    log_root \u003d logging.getLogger(None).logger"},{"line_number":55,"context_line":"    to_replace \u003d [h for h in log_root.handlers"},{"line_number":56,"context_line":"                  if isinstance(h, handlers.WatchedFileHandler)]"},{"line_number":57,"context_line":"    for handler in to_replace:"},{"line_number":58,"context_line":"        new_handler \u003d std_logging.FileHandler(handler.baseFilename,"},{"line_number":59,"context_line":"                                              mode\u003dhandler.mode,"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_712947e5","line":56,"in_reply_to":"3a961159_fb1b587e","updated":"2014-12-12 17:34:27.000000000","message":"But from a security point of view neutron user has too much permissions (through rootwrap).\n\ni will split the change in 2:\n\n * This change will reduce permissions without new requirements (so from root user/group to neutron user)\n * Next (and new) one will try to reduce permissions to nobody","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"b876119e52304e828001e72f73f9225885d07fbb","unresolved":false,"context_lines":[{"line_number":140,"context_line":"    \"\"\""},{"line_number":141,"context_line":"    def __init__(self, pidfile, stdin\u003d\u0027/dev/null\u0027, stdout\u003d\u0027/dev/null\u0027,"},{"line_number":142,"context_line":"                 stderr\u003d\u0027/dev/null\u0027, procname\u003d\u0027python\u0027, uuid\u003dNone,"},{"line_number":143,"context_line":"                 user\u003dNone, group\u003dNone):"},{"line_number":144,"context_line":"        self.stdin \u003d stdin"},{"line_number":145,"context_line":"        self.stdout \u003d stdout"},{"line_number":146,"context_line":"        self.stderr \u003d stderr"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_fe026608","line":143,"updated":"2014-12-12 16:52:52.000000000","message":"Kudos to implementing that in Daemon class!","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"66505c51f70dd045cd86e41f07c659ccc085f64e","unresolved":false,"context_lines":[{"line_number":140,"context_line":"    \"\"\""},{"line_number":141,"context_line":"    def __init__(self, pidfile, stdin\u003d\u0027/dev/null\u0027, stdout\u003d\u0027/dev/null\u0027,"},{"line_number":142,"context_line":"                 stderr\u003d\u0027/dev/null\u0027, procname\u003d\u0027python\u0027, uuid\u003dNone,"},{"line_number":143,"context_line":"                 user\u003dNone, group\u003dNone):"},{"line_number":144,"context_line":"        self.stdin \u003d stdin"},{"line_number":145,"context_line":"        self.stdout \u003d stdout"},{"line_number":146,"context_line":"        self.stderr \u003d stderr"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_1167234e","line":143,"in_reply_to":"3a961159_fe026608","updated":"2014-12-12 17:34:27.000000000","message":"In fact, the current proposal is perhaps dummy as setting user or group is not enough to reduce permissions :).\n\ni should perhaps do the following:\n\n  def run(self):\n    self.init()\n    drop_privileges(self.user, self.group)\n    self._run()\n\n  def init(self):\n    pass\n\n  def _run(self): \n    pass\n\ninit is not required by the metadata-proxy but could be required if we want to listen on a port before dropping privileges","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"18f6a3b7296d54c4f5477343e25a7cd53d63fbc7","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"def setuid(user_id_or_name):"},{"line_number":30,"context_line":"    try:"},{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_e79d0459","line":30,"updated":"2014-12-17 09:01:59.000000000","message":"I think you missed it so I\u0027m writing this again: the setuid and setgid looks a lot alike and could be shrieked if we enforcing the calling party (l3_agent and future users) to use uid/gid (as opposed to user and group names, causing lines 33 and 41), and then you don\u0027t have to mess with this at all?\n\nThis is, after all, somewhat of an advanced feature. If a user ends up using this script directly and decides he needs to daemonize and drop privileges, I\u0027d assume he knows how to read /etc/passwd and get the uid and gid he needs.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"1f3c73a8687eeb226ee33533a6499bcfcb4ad5fd","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"def setuid(user_id_or_name):"},{"line_number":30,"context_line":"    try:"},{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_fee109fd","line":30,"in_reply_to":"3a961159_98e73de4","updated":"2014-12-17 12:35:17.000000000","message":"I agree with Ihar, user/group names are more stable and more meaningful ... uids/gids are only supported because i am not sure which one is more stable between nobody and 65534 (iirc, CentOS5 nobody user name was nfsnobody).","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"9797cee31cdb123891a7658aeea2345c16d3af55","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"def setuid(user_id_or_name):"},{"line_number":30,"context_line":"    try:"},{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_98e73de4","line":30,"in_reply_to":"3a961159_e79d0459","updated":"2014-12-17 10:43:52.000000000","message":"I respectfully disagree. I think the idea is to make proxy process running as neutron user/group by default, so we should put some default values for the setting in l3 agent, and those should be symbolic, not numbers. This is because numbers are not stable throughout different systems, and names probably are.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"446faa9b0a19d4b23a82c6e3cd3e8a1e9b3e5787","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"def setuid(user_id_or_name):"},{"line_number":30,"context_line":"    try:"},{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_8bca8618","line":30,"in_reply_to":"3a961159_fee109fd","updated":"2014-12-17 13:20:32.000000000","message":"Alright :)","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":29,"context_line":"def setuid(user_id_or_name):"},{"line_number":30,"context_line":"    try:"},{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"},{"line_number":34,"context_line":"    os.setuid(new_uid)"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_a3e9d0b8","line":32,"updated":"2014-12-19 19:38:29.000000000","message":"It may also receive e.g. TypeError if None or dict() or any other invalid type is passed. I don\u0027t know whether we want to handle all of them though.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":29,"context_line":"def setuid(user_id_or_name):"},{"line_number":30,"context_line":"    try:"},{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"},{"line_number":34,"context_line":"    os.setuid(new_uid)"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_bb31e55b","line":32,"in_reply_to":"3a961159_a3e9d0b8","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"},{"line_number":34,"context_line":"    os.setuid(new_uid)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"def setgid(group_id_or_name):"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_83fbf479","line":34,"updated":"2014-12-19 19:38:29.000000000","message":"it\u0027s probably better to be paranoid here and check result, and fail if it\u0027s not zero.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":31,"context_line":"        new_uid \u003d int(user_id_or_name)"},{"line_number":32,"context_line":"    except ValueError:"},{"line_number":33,"context_line":"        new_uid \u003d pwd.getpwnam(user_id_or_name).pw_uid"},{"line_number":34,"context_line":"    os.setuid(new_uid)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"def setgid(group_id_or_name):"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_bb8e452c","line":34,"in_reply_to":"3a961159_83fbf479","updated":"2014-12-22 11:32:20.000000000","message":"os.setuid/gid/groups return nothing because they raise an OSError error if they fail to perform the requested operation ... but it\u0027s not clearly documented python doc (sick).\n\nPerhaps we should sys.exit in such case.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":37,"context_line":"def setgid(group_id_or_name):"},{"line_number":38,"context_line":"    try:"},{"line_number":39,"context_line":"        new_gid \u003d int(group_id_or_name)"},{"line_number":40,"context_line":"    except ValueError:"},{"line_number":41,"context_line":"        new_gid \u003d grp.getgrnam(group_id_or_name).gr_gid"},{"line_number":42,"context_line":"    os.setgid(new_gid)"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_c3f89c7e","line":40,"updated":"2014-12-19 19:38:29.000000000","message":"same comments as above apply here.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":37,"context_line":"def setgid(group_id_or_name):"},{"line_number":38,"context_line":"    try:"},{"line_number":39,"context_line":"        new_gid \u003d int(group_id_or_name)"},{"line_number":40,"context_line":"    except ValueError:"},{"line_number":41,"context_line":"        new_gid \u003d grp.getgrnam(group_id_or_name).gr_gid"},{"line_number":42,"context_line":"    os.setgid(new_gid)"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_3b5c154b","line":40,"in_reply_to":"3a961159_c3f89c7e","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":51,"context_line":"        LOG.critical(_LC(\u0027Root permissions are required to drop privileges.\u0027))"},{"line_number":52,"context_line":"        sys.exit(99)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    os.setgroups([])"},{"line_number":55,"context_line":"    if group:"},{"line_number":56,"context_line":"        setgid(group)"},{"line_number":57,"context_line":"    if user:"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_23eb20dd","line":54,"updated":"2014-12-19 19:38:29.000000000","message":"shouldn\u0027t we check result of dropping effective groups here? and probably if result is not 0, then fail.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":51,"context_line":"        LOG.critical(_LC(\u0027Root permissions are required to drop privileges.\u0027))"},{"line_number":52,"context_line":"        sys.exit(99)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    os.setgroups([])"},{"line_number":55,"context_line":"    if group:"},{"line_number":56,"context_line":"        setgid(group)"},{"line_number":57,"context_line":"    if user:"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_3b6b351f","line":54,"in_reply_to":"3a961159_23eb20dd","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"18f6a3b7296d54c4f5477343e25a7cd53d63fbc7","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        sys.exit(99)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    os.setgroups([])"},{"line_number":55,"context_line":"    if group:"},{"line_number":56,"context_line":"        setgid(group)"},{"line_number":57,"context_line":"    if user:"},{"line_number":58,"context_line":"        setuid(user)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_27ec6cf3","line":55,"updated":"2014-12-17 09:01:59.000000000","message":"In the scenario where the user specifies \u0027metadata_proxy_user\u0027 as root, for example, then doing \u0027setuid(root)\u0027 is pointless since we\u0027re already running as root.\n\nI think that there should be a specific check of \u0027is the user I\u0027m dropping privileges to the same as the current user I\u0027m running?\u0027 and if so, don\u0027t drop.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"1f3c73a8687eeb226ee33533a6499bcfcb4ad5fd","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        sys.exit(99)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    os.setgroups([])"},{"line_number":55,"context_line":"    if group:"},{"line_number":56,"context_line":"        setgid(group)"},{"line_number":57,"context_line":"    if user:"},{"line_number":58,"context_line":"        setuid(user)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_beb781f4","line":55,"in_reply_to":"3a961159_27ec6cf3","updated":"2014-12-17 12:35:17.000000000","message":"Such test will be done in setgid/setuid.\n\nOnly root is allowed to use os.setgroups() ... from my point of view calling drop_privileges(user) with user \u003d\u003d  current_user !\u003d \u0027root\u0027 is an invalid use of drop_privileges.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        sys.exit(99)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    os.setgroups([])"},{"line_number":55,"context_line":"    if group:"},{"line_number":56,"context_line":"        setgid(group)"},{"line_number":57,"context_line":"    if user:"},{"line_number":58,"context_line":"        setuid(user)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_5b7481fd","line":55,"in_reply_to":"3a961159_b041650d","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"446faa9b0a19d4b23a82c6e3cd3e8a1e9b3e5787","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        sys.exit(99)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    os.setgroups([])"},{"line_number":55,"context_line":"    if group:"},{"line_number":56,"context_line":"        setgid(group)"},{"line_number":57,"context_line":"    if user:"},{"line_number":58,"context_line":"        setuid(user)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_cbebae76","line":55,"in_reply_to":"3a961159_beb781f4","updated":"2014-12-17 13:20:32.000000000","message":"I didn\u0027t understand from your comment if you\u0027re planning to implement this test in the functions above or not... :(","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"93326e675a7b80cc73f3e8aaae618bbdfe07c3b3","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        sys.exit(99)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    os.setgroups([])"},{"line_number":55,"context_line":"    if group:"},{"line_number":56,"context_line":"        setgid(group)"},{"line_number":57,"context_line":"    if user:"},{"line_number":58,"context_line":"        setuid(user)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_b041650d","line":55,"in_reply_to":"3a961159_cbebae76","updated":"2014-12-17 16:40:45.000000000","message":"user/group can be name or id, so the test will be done after new_gid/uid computation in setuid/setgid function defined in daemon module.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"18f6a3b7296d54c4f5477343e25a7cd53d63fbc7","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    if user:"},{"line_number":58,"context_line":"        setuid(user)"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    LOG.info(_LI(\"Metadata proxy runs with uid/gid: %(uid)s/%(gid)s\"),"},{"line_number":61,"context_line":"             {\u0027uid\u0027: os.getuid(), \u0027gid\u0027: os.getgid()})"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_67a4b4b9","line":60,"updated":"2014-12-17 09:01:59.000000000","message":"nit: though this class is only used by the metadata proxy code right now, this will change. Either way the string should change to \u0027Demonized process runs with ...\"","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"1f3c73a8687eeb226ee33533a6499bcfcb4ad5fd","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    if user:"},{"line_number":58,"context_line":"        setuid(user)"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    LOG.info(_LI(\"Metadata proxy runs with uid/gid: %(uid)s/%(gid)s\"),"},{"line_number":61,"context_line":"             {\u0027uid\u0027: os.getuid(), \u0027gid\u0027: os.getgid()})"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_1eb9752e","line":60,"in_reply_to":"3a961159_67a4b4b9","updated":"2014-12-17 12:35:17.000000000","message":"oups\n\nDone","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"18f6a3b7296d54c4f5477343e25a7cd53d63fbc7","unresolved":false,"context_lines":[{"line_number":184,"context_line":"        \"\"\"Override this method and call super().run when subclassing Daemon."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"        start() will call this method after the process has daemonized."},{"line_number":187,"context_line":"        \"\"\""},{"line_number":188,"context_line":"        drop_privileges(self.user, self.group)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_876e00c8","line":187,"updated":"2014-12-17 09:01:59.000000000","message":"Can we see a use-case where we\u0027d want to drop privileges when --nodaemonize is used? Correct me if I\u0027m wrong, but if we don\u0027t daemonize then the euid and egid are used anyway when attempting to read the files, thus making the whole procedure irrelevant.\n\nIf we can\u0027t see such a use-case and the procedure should only be done when --daemonize, I would rather see the call to drop_privileges() in the \u0027start\u0027 function instead (specifically, after L180). This way, this class\u0027 API doesn\u0027t change and the function is always called, regardless of whether or not the user forgets to call super().run.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":184,"context_line":"        \"\"\"Override this method and call super().run when subclassing Daemon."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"        start() will call this method after the process has daemonized."},{"line_number":187,"context_line":"        \"\"\""},{"line_number":188,"context_line":"        drop_privileges(self.user, self.group)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_e348382f","line":187,"in_reply_to":"3a961159_876e00c8","updated":"2014-12-19 19:38:29.000000000","message":"(No action needed)\n\ndaemon mode seems to be independent from privileges it runs in. It\u0027s still correct to drop privileges in non-daemon mode, and it\u0027s effective.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"1f3c73a8687eeb226ee33533a6499bcfcb4ad5fd","unresolved":false,"context_lines":[{"line_number":184,"context_line":"        \"\"\"Override this method and call super().run when subclassing Daemon."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"        start() will call this method after the process has daemonized."},{"line_number":187,"context_line":"        \"\"\""},{"line_number":188,"context_line":"        drop_privileges(self.user, self.group)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_d9dc6777","line":187,"in_reply_to":"3a961159_876e00c8","updated":"2014-12-17 12:35:17.000000000","message":"You are assuming user/group are euid/egid. \n\nIMO, it\u0027s counter intuitive to drop privileges only in daemon mode ...","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"446faa9b0a19d4b23a82c6e3cd3e8a1e9b3e5787","unresolved":false,"context_lines":[{"line_number":184,"context_line":"        \"\"\"Override this method and call super().run when subclassing Daemon."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"        start() will call this method after the process has daemonized."},{"line_number":187,"context_line":"        \"\"\""},{"line_number":188,"context_line":"        drop_privileges(self.user, self.group)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_4bf7be59","line":187,"in_reply_to":"3a961159_d9dc6777","updated":"2014-12-17 13:20:32.000000000","message":"Fair enough","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"3493df070a3de1d2f0dfb3b2f71301dfccc524c7","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    if new_uid !\u003d 0:"},{"line_number":38,"context_line":"        try:"},{"line_number":39,"context_line":"            os.setuid(new_uid)"},{"line_number":40,"context_line":"        except Exception:"},{"line_number":41,"context_line":"            LOG.critical(_LC(\u0027Failed to set uid %s\u0027), new_uid)"},{"line_number":42,"context_line":"            sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_8051f431","line":40,"updated":"2014-12-23 10:33:54.000000000","message":"It\u0027s documented at: https://docs.python.org/2/library/os.html\n\n\"Note All functions in this module raise OSError in the case of invalid or inaccessible file names and paths, or other arguments that have the correct type, but are not accepted by the operating system.\"\n\nI don\u0027t know whether we should handle OSError here only, and allow other types of exceptions to propagate. What do you think?","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"471ae34f3e57358688e26fdcb93df8b66f129461","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    if new_uid !\u003d 0:"},{"line_number":38,"context_line":"        try:"},{"line_number":39,"context_line":"            os.setuid(new_uid)"},{"line_number":40,"context_line":"        except Exception:"},{"line_number":41,"context_line":"            LOG.critical(_LC(\u0027Failed to set uid %s\u0027), new_uid)"},{"line_number":42,"context_line":"            sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_98423666","line":40,"in_reply_to":"3a961159_8051f431","updated":"2014-12-24 10:45:18.000000000","message":"Done","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"3493df070a3de1d2f0dfb3b2f71301dfccc524c7","unresolved":false,"context_lines":[{"line_number":39,"context_line":"            os.setuid(new_uid)"},{"line_number":40,"context_line":"        except Exception:"},{"line_number":41,"context_line":"            LOG.critical(_LC(\u0027Failed to set uid %s\u0027), new_uid)"},{"line_number":42,"context_line":"            sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"def setgid(group_id_or_name):"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_9b016507","line":42,"updated":"2014-12-23 10:33:54.000000000","message":"I thought about those setuid/setgid functions as a library, meaning it won\u0027t just exit the whole process but instead return result to its caller to decide what to do next. What do you think?","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"471ae34f3e57358688e26fdcb93df8b66f129461","unresolved":false,"context_lines":[{"line_number":39,"context_line":"            os.setuid(new_uid)"},{"line_number":40,"context_line":"        except Exception:"},{"line_number":41,"context_line":"            LOG.critical(_LC(\u0027Failed to set uid %s\u0027), new_uid)"},{"line_number":42,"context_line":"            sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"def setgid(group_id_or_name):"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_584c4e9e","line":42,"in_reply_to":"3a961159_7204d317","updated":"2014-12-24 10:45:18.000000000","message":"Done","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"dac4d428662aacff9080bf513c9cea4fd0a60f9f","unresolved":false,"context_lines":[{"line_number":39,"context_line":"            os.setuid(new_uid)"},{"line_number":40,"context_line":"        except Exception:"},{"line_number":41,"context_line":"            LOG.critical(_LC(\u0027Failed to set uid %s\u0027), new_uid)"},{"line_number":42,"context_line":"            sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"def setgid(group_id_or_name):"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_7204d317","line":42,"in_reply_to":"3a961159_9b016507","updated":"2014-12-23 16:56:33.000000000","message":"I prefer to raise an error to ensure consistency with os.setuid/setgid behavior and prefer to raise a SystemExit (or a subclass) to ensure without a specific catch that a permissions drop failure implies an exit.\n\nsetuid/setgid should perhaps raise a SystemExit subclass instead of a SystemExit.","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"a3af574cd5500895dc960c24ca0b603eaad36788","unresolved":false,"context_lines":[{"line_number":55,"context_line":"            sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"def drop_privileges(user\u003dNone, group\u003dNone):"},{"line_number":59,"context_line":"    \"\"\"Drop privileges to user/group privileges.\"\"\""},{"line_number":60,"context_line":"    if user is None and group is None:"},{"line_number":61,"context_line":"        return"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_ca9de467","line":58,"updated":"2014-12-22 23:09:57.000000000","message":"does this method expect to work if one only specifies user or group?","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"dac4d428662aacff9080bf513c9cea4fd0a60f9f","unresolved":false,"context_lines":[{"line_number":55,"context_line":"            sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"def drop_privileges(user\u003dNone, group\u003dNone):"},{"line_number":59,"context_line":"    \"\"\"Drop privileges to user/group privileges.\"\"\""},{"line_number":60,"context_line":"    if user is None and group is None:"},{"line_number":61,"context_line":"        return"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_7be03926","line":58,"in_reply_to":"3a961159_ca9de467","updated":"2014-12-23 16:56:33.000000000","message":"Yes","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"dac4d428662aacff9080bf513c9cea4fd0a60f9f","unresolved":false,"context_lines":[{"line_number":60,"context_line":"    if user is None and group is None:"},{"line_number":61,"context_line":"        return"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"    if os.geteuid() !\u003d 0:"},{"line_number":64,"context_line":"        LOG.critical(_LC(\u0027Root permissions are required to drop privileges.\u0027))"},{"line_number":65,"context_line":"        sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_98e241d3","line":63,"updated":"2014-12-23 16:56:33.000000000","message":"Not sure we need to check current euid as os.setgroup/setgid/setuid do it implicitly","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"3493df070a3de1d2f0dfb3b2f71301dfccc524c7","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    try:"},{"line_number":68,"context_line":"        os.setgroups([])"},{"line_number":69,"context_line":"    except Exception:"},{"line_number":70,"context_line":"        LOG.critical(_LC(\u0027Failed to remove supplemental groups\u0027))"},{"line_number":71,"context_line":"        sys.exit(NO_PERM_RETURN_CODE)"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_7b2d998e","line":68,"updated":"2014-12-23 10:33:54.000000000","message":"Should we drop groups if group is None?","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"471ae34f3e57358688e26fdcb93df8b66f129461","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    try:"},{"line_number":68,"context_line":"        os.setgroups([])"},{"line_number":69,"context_line":"    except Exception:"},{"line_number":70,"context_line":"        LOG.critical(_LC(\u0027Failed to remove supplemental groups\u0027))"},{"line_number":71,"context_line":"        sys.exit(NO_PERM_RETURN_CODE)"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_187f26ac","line":68,"in_reply_to":"3a961159_1879f12e","updated":"2014-12-24 10:45:18.000000000","message":"Done","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"dac4d428662aacff9080bf513c9cea4fd0a60f9f","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        sys.exit(NO_PERM_RETURN_CODE)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    try:"},{"line_number":68,"context_line":"        os.setgroups([])"},{"line_number":69,"context_line":"    except Exception:"},{"line_number":70,"context_line":"        LOG.critical(_LC(\u0027Failed to remove supplemental groups\u0027))"},{"line_number":71,"context_line":"        sys.exit(NO_PERM_RETURN_CODE)"}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_1879f12e","line":68,"in_reply_to":"3a961159_7b2d998e","updated":"2014-12-23 16:56:33.000000000","message":"good question, no?","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"dac4d428662aacff9080bf513c9cea4fd0a60f9f","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    if user:"},{"line_number":75,"context_line":"        setuid(user)"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    LOG.info(_LI(\"Daemonized process runs with uid/gid: %(uid)s/%(gid)s\"),"},{"line_number":78,"context_line":"             {\u0027uid\u0027: os.getuid(), \u0027gid\u0027: os.getgid()})"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_38f06d90","line":77,"updated":"2014-12-23 16:56:33.000000000","message":"Daemonized process \u003d\u003d\u003e Process","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"471ae34f3e57358688e26fdcb93df8b66f129461","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    if user:"},{"line_number":75,"context_line":"        setuid(user)"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    LOG.info(_LI(\"Daemonized process runs with uid/gid: %(uid)s/%(gid)s\"),"},{"line_number":78,"context_line":"             {\u0027uid\u0027: os.getuid(), \u0027gid\u0027: os.getgid()})"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"3a961159_387a22ba","line":77,"in_reply_to":"3a961159_38f06d90","updated":"2014-12-24 10:45:18.000000000","message":"Done","commit_id":"336a9a0ca885eb50798cf1a272d17996bc65f37c"}],"neutron/agent/metadata/agent.py":[{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"b876119e52304e828001e72f73f9225885d07fbb","unresolved":false,"context_lines":[{"line_number":337,"context_line":"        self._socket \u003d eventlet.listen(file_socket,"},{"line_number":338,"context_line":"                                       family\u003dsocket.AF_UNIX,"},{"line_number":339,"context_line":"                                       backlog\u003dbacklog)"},{"line_number":340,"context_line":"        os.chmod(file_socket, stat.S_IRWXU | stat.S_IRWXG | stat.S_IRWXO)"},{"line_number":341,"context_line":""},{"line_number":342,"context_line":"        self._launch(application, workers\u003dworkers)"},{"line_number":343,"context_line":""}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_9e3fa2b3","line":340,"updated":"2014-12-12 16:52:52.000000000","message":"That looks very suspicious. Is that because you need to allow access to the socket for nobody? If so, I\u0027d really like to see the patch scope narrowed to be able to run the proxy process with the same user and group as the agent itself, and then follow up with a separate patch to allow even more strict user to execute it.","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"66505c51f70dd045cd86e41f07c659ccc085f64e","unresolved":false,"context_lines":[{"line_number":337,"context_line":"        self._socket \u003d eventlet.listen(file_socket,"},{"line_number":338,"context_line":"                                       family\u003dsocket.AF_UNIX,"},{"line_number":339,"context_line":"                                       backlog\u003dbacklog)"},{"line_number":340,"context_line":"        os.chmod(file_socket, stat.S_IRWXU | stat.S_IRWXG | stat.S_IRWXO)"},{"line_number":341,"context_line":""},{"line_number":342,"context_line":"        self._launch(application, workers\u003dworkers)"},{"line_number":343,"context_line":""}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_545b59f5","line":340,"in_reply_to":"3a961159_9e3fa2b3","updated":"2014-12-12 17:34:27.000000000","message":"ok","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"}],"neutron/agent/metadata/namespace_proxy.py":[{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"def drop_privileges(user, group):"},{"line_number":134,"context_line":"    if user is not None or group is not None:"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        if os.getuid() !\u003d 0:"},{"line_number":137,"context_line":"            LOG.error(_LE(\u0027Root permissions are required to drop privileges.\u0027))"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_6491d998","line":134,"updated":"2014-12-10 17:35:45.000000000","message":"How about the following? (this isn\u0027t a must for me):\n\n if any(t is not None for t in [user, group])","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"def drop_privileges(user, group):"},{"line_number":134,"context_line":"    if user is not None or group is not None:"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        if os.getuid() !\u003d 0:"},{"line_number":137,"context_line":"            LOG.error(_LE(\u0027Root permissions are required to drop privileges.\u0027))"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_75ed01ef","line":134,"in_reply_to":"3a961159_6491d998","updated":"2014-12-10 18:45:56.000000000","message":"imo, it\u0027s not really readable","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":134,"context_line":"    if user is not None or group is not None:"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        if os.getuid() !\u003d 0:"},{"line_number":137,"context_line":"            LOG.error(_LE(\u0027Root permissions are required to drop privileges.\u0027))"},{"line_number":138,"context_line":"            raise SystemExit(99)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"        # Remove group privileges"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_049e5556","line":137,"updated":"2014-12-10 17:35:45.000000000","message":"I think this deserves the LOG.critical() notation.","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":134,"context_line":"    if user is not None or group is not None:"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        if os.getuid() !\u003d 0:"},{"line_number":137,"context_line":"            LOG.error(_LE(\u0027Root permissions are required to drop privileges.\u0027))"},{"line_number":138,"context_line":"            raise SystemExit(99)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"        # Remove group privileges"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_b5be89d2","line":137,"in_reply_to":"3a961159_049e5556","updated":"2014-12-10 18:45:56.000000000","message":"Done","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        # Remove group privileges"},{"line_number":141,"context_line":"        os.setgroups([])"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"        if group:"},{"line_number":144,"context_line":"            # Change gid"},{"line_number":145,"context_line":"            if group.isdigit():"},{"line_number":146,"context_line":"                new_gid \u003d int(group)"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_4464dde4","line":143,"updated":"2014-12-10 17:35:45.000000000","message":"the \u0027if group\u0027 and \u0027if user\u0027 looks a lot alike. How about enforcing the calling party (l3_agent) to use uid/gid, and then you don\u0027t have to mess with this?","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        # Remove group privileges"},{"line_number":141,"context_line":"        os.setgroups([])"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"        if group:"},{"line_number":144,"context_line":"            # Change gid"},{"line_number":145,"context_line":"            if group.isdigit():"},{"line_number":146,"context_line":"                new_gid \u003d int(group)"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_d5b155e2","line":143,"in_reply_to":"3a961159_4464dde4","updated":"2014-12-10 18:45:56.000000000","message":"According to your change[1], the Daemon class seems the right place\n\n[1]https://review.openstack.org/128258","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":145,"context_line":"            if group.isdigit():"},{"line_number":146,"context_line":"                new_gid \u003d int(group)"},{"line_number":147,"context_line":"            else:"},{"line_number":148,"context_line":"                new_gid \u003d grp.getgrnam(group)[2]"},{"line_number":149,"context_line":"            os.setgid(new_gid)"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"        if user:"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_61070b1d","line":148,"updated":"2014-12-10 17:35:45.000000000","message":"The [2] here doesn\u0027t look good. Is the return value really a tuple (or something else with attributes?) If it is a tuple, use a constant to reference this.","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":145,"context_line":"            if group.isdigit():"},{"line_number":146,"context_line":"                new_gid \u003d int(group)"},{"line_number":147,"context_line":"            else:"},{"line_number":148,"context_line":"                new_gid \u003d grp.getgrnam(group)[2]"},{"line_number":149,"context_line":"            os.setgid(new_gid)"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"        if user:"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_b58cc936","line":148,"in_reply_to":"3a961159_61070b1d","updated":"2014-12-10 18:45:56.000000000","message":"it\u0027s a namedtuple\n\nDone","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"b876119e52304e828001e72f73f9225885d07fbb","unresolved":false,"context_lines":[{"line_number":136,"context_line":"        self.network_id \u003d network_id"},{"line_number":137,"context_line":"        self.router_id \u003d router_id"},{"line_number":138,"context_line":"        self.port \u003d port"},{"line_number":139,"context_line":"        self.user \u003d user"},{"line_number":140,"context_line":"        self.group \u003d group"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"    def run(self):"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_9edb227b","line":139,"updated":"2014-12-12 16:52:52.000000000","message":"Don\u0027t we already set those attributes in super()?","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"715321217a43158187b55b2a7ceebf53fb06bbac","unresolved":false,"context_lines":[{"line_number":136,"context_line":"        self.network_id \u003d network_id"},{"line_number":137,"context_line":"        self.router_id \u003d router_id"},{"line_number":138,"context_line":"        self.port \u003d port"},{"line_number":139,"context_line":"        self.user \u003d user"},{"line_number":140,"context_line":"        self.group \u003d group"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"    def run(self):"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_bb31c15b","line":139,"in_reply_to":"3a961159_14dab14b","updated":"2014-12-15 15:44:35.000000000","message":"Done","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"66505c51f70dd045cd86e41f07c659ccc085f64e","unresolved":false,"context_lines":[{"line_number":136,"context_line":"        self.network_id \u003d network_id"},{"line_number":137,"context_line":"        self.router_id \u003d router_id"},{"line_number":138,"context_line":"        self.port \u003d port"},{"line_number":139,"context_line":"        self.user \u003d user"},{"line_number":140,"context_line":"        self.group \u003d group"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"    def run(self):"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_14dab14b","line":139,"in_reply_to":"3a961159_9edb227b","updated":"2014-12-12 17:34:27.000000000","message":"Daemon.user/group attribute are currently useless. I will finish the refactor in next PS.","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"b876119e52304e828001e72f73f9225885d07fbb","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        self.group \u003d group"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"    def run(self):"},{"line_number":143,"context_line":"        daemon.drop_privileges(user\u003dself.user, group\u003dself.group)"},{"line_number":144,"context_line":"        handler \u003d NetworkMetadataProxyHandler("},{"line_number":145,"context_line":"            self.network_id,"},{"line_number":146,"context_line":"            self.router_id)"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_beb8de2a","line":143,"updated":"2014-12-12 16:52:52.000000000","message":"Should we instead make Daemon to drop privileges in base class run(), and then call to super()? In that case, it will be enough for subclasses to set user and group to make it drop the privileges.","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"715321217a43158187b55b2a7ceebf53fb06bbac","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        self.group \u003d group"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"    def run(self):"},{"line_number":143,"context_line":"        daemon.drop_privileges(user\u003dself.user, group\u003dself.group)"},{"line_number":144,"context_line":"        handler \u003d NetworkMetadataProxyHandler("},{"line_number":145,"context_line":"            self.network_id,"},{"line_number":146,"context_line":"            self.router_id)"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_3b3dd12b","line":143,"in_reply_to":"3a961159_54851905","updated":"2014-12-15 15:44:35.000000000","message":"Done","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"66505c51f70dd045cd86e41f07c659ccc085f64e","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        self.group \u003d group"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"    def run(self):"},{"line_number":143,"context_line":"        daemon.drop_privileges(user\u003dself.user, group\u003dself.group)"},{"line_number":144,"context_line":"        handler \u003d NetworkMetadataProxyHandler("},{"line_number":145,"context_line":"            self.network_id,"},{"line_number":146,"context_line":"            self.router_id)"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a961159_54851905","line":143,"in_reply_to":"3a961159_beb8de2a","updated":"2014-12-12 17:34:27.000000000","message":"It seems strange to define a default Daemon.run() which only drop privileges but will allow:\n\n  def run(self):\n    # bind privileged port\n    super().run()\n    # run in unprivileged","commit_id":"84243c2a44218014c86ff21ed27ab99fe150b969"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"e9ffdb1150688786c11ab302fba105ee2fa060f7","unresolved":false,"context_lines":[{"line_number":183,"context_line":"    cfg.CONF(project\u003d\u0027neutron\u0027, default_config_files\u003d[])"},{"line_number":184,"context_line":"    config.setup_logging()"},{"line_number":185,"context_line":"    utils.log_opt_values(LOG)"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"    proxy \u003d ProxyDaemon(cfg.CONF.pid_file,"},{"line_number":188,"context_line":"                        cfg.CONF.metadata_port,"},{"line_number":189,"context_line":"                        network_id\u003dcfg.CONF.network_id,"}],"source_content_type":"text/x-python","patch_set":24,"id":"3a961159_1c3f8526","line":186,"updated":"2015-01-05 18:21:24.000000000","message":":\u0027(  Gratuitous whitespace change.","commit_id":"b78c5e54abd10fc71a46788110f9f36e6496414e"}],"neutron/common/config.py":[{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"7a7527cb5b57f4d9a85f71a803343a42a85cc750","unresolved":false,"context_lines":[{"line_number":180,"context_line":"                                   delay\u003dwatched_file_handler.delay)"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"def disable_logging_files_watch():"},{"line_number":184,"context_line":"    \"\"\"Replace WatchedFileHandlers by FileHandlers."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    WatchedFileHandler does not support to drop permissions after"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_97835555","line":183,"updated":"2014-12-10 17:35:45.000000000","message":"Documentation should say in which cases we\u0027ll want to do this, since this isn\u0027t trivial (specifically the part about daemonization).","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"8f7338525a215699125434f6f41e0065a5534e70","unresolved":false,"context_lines":[{"line_number":180,"context_line":"                                   delay\u003dwatched_file_handler.delay)"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"def disable_logging_files_watch():"},{"line_number":184,"context_line":"    \"\"\"Replace WatchedFileHandlers by FileHandlers."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    WatchedFileHandler does not support to drop permissions after"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_ba1cb878","line":183,"in_reply_to":"3a961159_97835555","updated":"2014-12-10 18:45:56.000000000","message":"I will move this function in Daemon class and update docstring to clarify things","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"fbf98894f9b9af5e7e20186daf63094503d5d1f7","unresolved":false,"context_lines":[{"line_number":180,"context_line":"                                   delay\u003dwatched_file_handler.delay)"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"def disable_logging_files_watch():"},{"line_number":184,"context_line":"    \"\"\"Replace WatchedFileHandlers by FileHandlers."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    WatchedFileHandler does not support to drop permissions after"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_8d9176f3","line":183,"in_reply_to":"3a961159_ba1cb878","updated":"2014-12-11 07:48:20.000000000","message":"I think it might be better to keep this here, as there might be some more (unforseen) uses for this function...\n\nWhat does the other say?","commit_id":"658c170904e735d98782135681a39a71ecdd48c5"}],"neutron/tests/unit/test_l3_agent.py":[{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"5c642f1a6f100f325c8c7604b0d03913e35d89c7","unresolved":false,"context_lines":[{"line_number":2312,"context_line":"        self.external_process_p.stop()"},{"line_number":2313,"context_line":"        ri \u003d l3_agent.RouterInfo(router_id, None, None)"},{"line_number":2314,"context_line":"        try:"},{"line_number":2315,"context_line":"            with mock.patch.object(os, \u0027geteuid\u0027, return_value\u003d123):"},{"line_number":2316,"context_line":"                with mock.patch(ip_class_path) as ip_mock:"},{"line_number":2317,"context_line":"                    self.agent._spawn_metadata_proxy(ri.router_id, ri.ns_name)"},{"line_number":2318,"context_line":"                    ip_mock.assert_has_calls(["}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_14371500","line":2315,"updated":"2014-11-25 11:21:29.000000000","message":"Why do we no longer want to mock ip_class_path?","commit_id":"d95625bb2b860a7f6530b727b150fe64da645036"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"1fa2e974065147bb93781bf60618c145ba358efd","unresolved":false,"context_lines":[{"line_number":2312,"context_line":"        self.external_process_p.stop()"},{"line_number":2313,"context_line":"        ri \u003d l3_agent.RouterInfo(router_id, None, None)"},{"line_number":2314,"context_line":"        try:"},{"line_number":2315,"context_line":"            with mock.patch.object(os, \u0027geteuid\u0027, return_value\u003d123):"},{"line_number":2316,"context_line":"                with mock.patch(ip_class_path) as ip_mock:"},{"line_number":2317,"context_line":"                    self.agent._spawn_metadata_proxy(ri.router_id, ri.ns_name)"},{"line_number":2318,"context_line":"                    ip_mock.assert_has_calls(["}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_5746ff7b","line":2315,"in_reply_to":"5a890539_14371500","updated":"2014-11-25 11:54:04.000000000","message":"It\u0027s still done on line 2316.","commit_id":"d95625bb2b860a7f6530b727b150fe64da645036"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"18f6a3b7296d54c4f5477343e25a7cd53d63fbc7","unresolved":false,"context_lines":[{"line_number":2241,"context_line":"        looping_call_p.start()"},{"line_number":2242,"context_line":"        self.agent \u003d l3_agent.L3NATAgent(HOSTNAME)"},{"line_number":2243,"context_line":""},{"line_number":2244,"context_line":"    def _test_spawn_metadata_proxy(self, expected_user, expected_group):"},{"line_number":2245,"context_line":"        router_id \u003d _uuid()"},{"line_number":2246,"context_line":"        metadata_port \u003d 8080"},{"line_number":2247,"context_line":"        ip_class_path \u003d \u0027neutron.agent.linux.ip_lib.IPWrapper\u0027"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_271b8ccb","line":2244,"updated":"2014-12-17 09:01:59.000000000","message":"Not sure if this shouldn\u0027t be tested in the functional suite, but will let others input their opinions.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"1f3c73a8687eeb226ee33533a6499bcfcb4ad5fd","unresolved":false,"context_lines":[{"line_number":2241,"context_line":"        looping_call_p.start()"},{"line_number":2242,"context_line":"        self.agent \u003d l3_agent.L3NATAgent(HOSTNAME)"},{"line_number":2243,"context_line":""},{"line_number":2244,"context_line":"    def _test_spawn_metadata_proxy(self, expected_user, expected_group):"},{"line_number":2245,"context_line":"        router_id \u003d _uuid()"},{"line_number":2246,"context_line":"        metadata_port \u003d 8080"},{"line_number":2247,"context_line":"        ip_class_path \u003d \u0027neutron.agent.linux.ip_lib.IPWrapper\u0027"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_f945a315","line":2244,"in_reply_to":"3a961159_271b8ccb","updated":"2014-12-17 12:35:17.000000000","message":"I think we should through a daemon module functional tests.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"93326e675a7b80cc73f3e8aaae618bbdfe07c3b3","unresolved":false,"context_lines":[{"line_number":2241,"context_line":"        looping_call_p.start()"},{"line_number":2242,"context_line":"        self.agent \u003d l3_agent.L3NATAgent(HOSTNAME)"},{"line_number":2243,"context_line":""},{"line_number":2244,"context_line":"    def _test_spawn_metadata_proxy(self, expected_user, expected_group):"},{"line_number":2245,"context_line":"        router_id \u003d _uuid()"},{"line_number":2246,"context_line":"        metadata_port \u003d 8080"},{"line_number":2247,"context_line":"        ip_class_path \u003d \u0027neutron.agent.linux.ip_lib.IPWrapper\u0027"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_f01f6d07","line":2244,"in_reply_to":"3a961159_2b9352fb","updated":"2014-12-17 16:40:45.000000000","message":"Great!","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":12444,"name":"John Schwarz","email":"jschwarz@redhat.com","username":"jschwarz"},"change_message_id":"446faa9b0a19d4b23a82c6e3cd3e8a1e9b3e5787","unresolved":false,"context_lines":[{"line_number":2241,"context_line":"        looping_call_p.start()"},{"line_number":2242,"context_line":"        self.agent \u003d l3_agent.L3NATAgent(HOSTNAME)"},{"line_number":2243,"context_line":""},{"line_number":2244,"context_line":"    def _test_spawn_metadata_proxy(self, expected_user, expected_group):"},{"line_number":2245,"context_line":"        router_id \u003d _uuid()"},{"line_number":2246,"context_line":"        metadata_port \u003d 8080"},{"line_number":2247,"context_line":"        ip_class_path \u003d \u0027neutron.agent.linux.ip_lib.IPWrapper\u0027"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_2b9352fb","line":2244,"in_reply_to":"3a961159_f945a315","updated":"2014-12-17 13:20:32.000000000","message":"Just in case you haven\u0027t noticed, look at [1] - I\u0027ve already implemented a more than basic functional test suite for the Daemon class and file, so it might be helpfull...\n\nI don\u0027t mind rebasing my code on yours if yours merges first ;-)\n\n[1] https://review.openstack.org/#/c/128258/","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":2274,"context_line":"                ], addl_env\u003dNone)"},{"line_number":2275,"context_line":"            ])"},{"line_number":2276,"context_line":""},{"line_number":2277,"context_line":"    def test_spawn_metadata_proxy_with_user(self):"},{"line_number":2278,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_user\u0027, \u0027user\u0027)"},{"line_number":2279,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_group\u0027, \u0027\u0027)"},{"line_number":2280,"context_line":"        self._test_spawn_metadata_proxy(\u0027user\u0027, \u0027456\u0027)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_23dfa0d7","line":2277,"updated":"2014-12-19 19:38:29.000000000","message":"those seem very similar. I think we may introduce another layer of indirection, like a method that sets user/group to proper ones, and check expected cli args.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":2274,"context_line":"                ], addl_env\u003dNone)"},{"line_number":2275,"context_line":"            ])"},{"line_number":2276,"context_line":""},{"line_number":2277,"context_line":"    def test_spawn_metadata_proxy_with_user(self):"},{"line_number":2278,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_user\u0027, \u0027user\u0027)"},{"line_number":2279,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_group\u0027, \u0027\u0027)"},{"line_number":2280,"context_line":"        self._test_spawn_metadata_proxy(\u0027user\u0027, \u0027456\u0027)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_bb9ba516","line":2277,"in_reply_to":"3a961159_23dfa0d7","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":2287,"context_line":"    def test_spawn_metadata_proxy(self):"},{"line_number":2288,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_user\u0027, \u0027\u0027)"},{"line_number":2289,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_group\u0027, \u0027\u0027)"},{"line_number":2290,"context_line":"        self._test_spawn_metadata_proxy(\u0027123\u0027, \u0027456\u0027)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_63f4485b","line":2290,"updated":"2014-12-19 19:38:29.000000000","message":"there is no test for uid/gid numbers passed thru configuration.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":2287,"context_line":"    def test_spawn_metadata_proxy(self):"},{"line_number":2288,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_user\u0027, \u0027\u0027)"},{"line_number":2289,"context_line":"        cfg.CONF.set_override(\u0027metadata_proxy_group\u0027, \u0027\u0027)"},{"line_number":2290,"context_line":"        self._test_spawn_metadata_proxy(\u0027123\u0027, \u0027456\u0027)"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_9b96e9ee","line":2290,"in_reply_to":"3a961159_63f4485b","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"}],"neutron/tests/unit/test_linux_daemon.py":[{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"2c4cdab2ec4743218790ef1ceb157629ef52ba82","unresolved":false,"context_lines":[{"line_number":94,"context_line":"                self.assertRaises(SystemExit, daemon.drop_privileges, \u0027user\u0027)"},{"line_number":95,"context_line":"                log_critical.assert_once_with(mock.ANY)"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"class TestPidfile(base.BaseTestCase):"},{"line_number":99,"context_line":"    def setUp(self):"},{"line_number":100,"context_line":"        super(TestPidfile, self).setUp()"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_0355441d","line":97,"updated":"2014-12-19 19:38:29.000000000","message":"no tests for uid/gid form of arguments.","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"396ea530f8cb9a583dbf4b842a7637bb5f03c371","unresolved":false,"context_lines":[{"line_number":94,"context_line":"                self.assertRaises(SystemExit, daemon.drop_privileges, \u0027user\u0027)"},{"line_number":95,"context_line":"                log_critical.assert_once_with(mock.ANY)"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"class TestPidfile(base.BaseTestCase):"},{"line_number":99,"context_line":"    def setUp(self):"},{"line_number":100,"context_line":"        super(TestPidfile, self).setUp()"}],"source_content_type":"text/x-python","patch_set":22,"id":"3a961159_fb460d7a","line":97,"in_reply_to":"3a961159_0355441d","updated":"2014-12-22 11:32:20.000000000","message":"Done","commit_id":"b97abf4828f59d079554b2303cc8df01251210ea"}],"requirements.txt":[{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"5c1fa628f4af5573f4260272f9d57595f27b2800","unresolved":false,"context_lines":[{"line_number":18,"context_line":"keystonemiddleware\u003e\u003d1.0.0"},{"line_number":19,"context_line":"netaddr\u003e\u003d0.7.12"},{"line_number":20,"context_line":"python-neutronclient\u003e\u003d2.3.6,\u003c3"},{"line_number":21,"context_line":"#SQLAlchemy\u003e\u003d0.9.7,\u003c\u003d0.9.99"},{"line_number":22,"context_line":"WebOb\u003e\u003d1.2.3"},{"line_number":23,"context_line":"python-keystoneclient\u003e\u003d0.11.1"},{"line_number":24,"context_line":"alembic\u003e\u003d0.6.4"}],"source_content_type":"text/plain","patch_set":13,"id":"3a961159_e9e847b6","line":21,"updated":"2014-12-10 16:05:07.000000000","message":"oups","commit_id":"c670ff2b258d5c196f39c29b9315f00ab29ac34f"}]}