)]}'
{"etc/neutron/rootwrap.d/rootwrap.filters":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"6d983cfeb14cfc076a3a877aa84a8ad0bbef1739","unresolved":true,"context_lines":[{"line_number":38,"context_line":"###############################################################################"},{"line_number":39,"context_line":"# \"sleep\" command, only for testing"},{"line_number":40,"context_line":"sleep: RegExpFilter, sleep, root, sleep, \\d+"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"###############################################################################"},{"line_number":43,"context_line":"# DHCP"},{"line_number":44,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"2baeb627_20a68725","line":41,"updated":"2021-03-31 19:17:10.000000000","message":"this should be removed. if it just for testing we dont need root wrap.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"9e3719bab649be0ee8162e10668b179ca381316a","unresolved":true,"context_lines":[{"line_number":38,"context_line":"###############################################################################"},{"line_number":39,"context_line":"# \"sleep\" command, only for testing"},{"line_number":40,"context_line":"sleep: RegExpFilter, sleep, root, sleep, \\d+"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"###############################################################################"},{"line_number":43,"context_line":"# DHCP"},{"line_number":44,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"c1c525c4_8b08d0b7","line":41,"in_reply_to":"2baeb627_20a68725","updated":"2021-03-31 20:14:37.000000000","message":"We need it because it\u0027s spawned as root (some test cases)","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"cecc84400e4b65b464b481e6673174f77a1e05e4","unresolved":true,"context_lines":[{"line_number":38,"context_line":"###############################################################################"},{"line_number":39,"context_line":"# \"sleep\" command, only for testing"},{"line_number":40,"context_line":"sleep: RegExpFilter, sleep, root, sleep, \\d+"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"###############################################################################"},{"line_number":43,"context_line":"# DHCP"},{"line_number":44,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"936f4155_6631f690","line":41,"in_reply_to":"6d0a5cc1_122dda93","updated":"2021-04-02 09:52:16.000000000","message":"You are right, if this is the last command using rootwrap we could remove it. We cannot use privsep because I need the PID of the running process to kill it. Using privsep masks the PID (and it\u0027s the privsep daemon one).","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"179885e0df720b36e8783aa23978900dc35dbc84","unresolved":true,"context_lines":[{"line_number":38,"context_line":"###############################################################################"},{"line_number":39,"context_line":"# \"sleep\" command, only for testing"},{"line_number":40,"context_line":"sleep: RegExpFilter, sleep, root, sleep, \\d+"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"###############################################################################"},{"line_number":43,"context_line":"# DHCP"},{"line_number":44,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"6d0a5cc1_122dda93","line":41,"in_reply_to":"c1c525c4_8b08d0b7","updated":"2021-04-01 12:30:22.000000000","message":"my point was the test code can just call sudo directly or process exec without rootwrap.\nits test code not production so i dont htink we need to have it run under rootwrap.\nfor example is this was the only remaining usage we would not keep this right we would just rewrite the test to use privespe or do something else to not have to carry rootwrap as a dependency .","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"6d983cfeb14cfc076a3a877aa84a8ad0bbef1739","unresolved":true,"context_lines":[{"line_number":51,"context_line":"# ip_lib"},{"line_number":52,"context_line":"ip: IpFilter, ip, root"},{"line_number":53,"context_line":"ip_exec: IpNetnsExecFilter, ip, root"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"###############################################################################"},{"line_number":56,"context_line":"# DIBBLER"},{"line_number":57,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"a8f3e664_53c20693","line":54,"updated":"2021-03-31 19:17:10.000000000","message":"the ip command should be able to be relaced with pyroute2 no?","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"9e3719bab649be0ee8162e10668b179ca381316a","unresolved":true,"context_lines":[{"line_number":51,"context_line":"# ip_lib"},{"line_number":52,"context_line":"ip: IpFilter, ip, root"},{"line_number":53,"context_line":"ip_exec: IpNetnsExecFilter, ip, root"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"###############################################################################"},{"line_number":56,"context_line":"# DIBBLER"},{"line_number":57,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"988db223_7b3dfb58","line":54,"in_reply_to":"a8f3e664_53c20693","updated":"2021-03-31 20:14:37.000000000","message":"Right, the \"ip\" filter should not be here anymore.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"fbc6fd1f596de0d85a839c4e69c030369251ca11","unresolved":true,"context_lines":[{"line_number":56,"context_line":"# DIBBLER"},{"line_number":57,"context_line":"###############################################################################"},{"line_number":58,"context_line":"# prefix_delegation_agent"},{"line_number":59,"context_line":"dibbler-client: CommandFilter, dibbler-client, root"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"###############################################################################"},{"line_number":62,"context_line":"# IPSET"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"51414d26_3a6593ad","line":59,"updated":"2021-03-31 06:52:36.000000000","message":"this should IMO be in the L3 section as it\u0027s spawned by L3 agent, no?","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"1382b39e08f42faf2001affb924f9ea78d25539c","unresolved":true,"context_lines":[{"line_number":56,"context_line":"# DIBBLER"},{"line_number":57,"context_line":"###############################################################################"},{"line_number":58,"context_line":"# prefix_delegation_agent"},{"line_number":59,"context_line":"dibbler-client: CommandFilter, dibbler-client, root"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"###############################################################################"},{"line_number":62,"context_line":"# IPSET"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"36c8f976_07ea4724","line":59,"in_reply_to":"51414d26_3a6593ad","updated":"2021-03-31 07:11:02.000000000","message":"That\u0027s right. I\u0027ll move it.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"fbc6fd1f596de0d85a839c4e69c030369251ca11","unresolved":true,"context_lines":[{"line_number":63,"context_line":"###############################################################################"},{"line_number":64,"context_line":"# neutron/agent/linux/iptables_firewall.py"},{"line_number":65,"context_line":"#   \"ipset\", \"-A\", ..."},{"line_number":66,"context_line":"ipset: CommandFilter, ipset, root"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"###############################################################################"},{"line_number":69,"context_line":"# L3"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"b2440936_a923cb77","line":66,"updated":"2021-03-31 06:52:36.000000000","message":"this one isn\u0027t \"long running command\" so do we need it here?","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"1382b39e08f42faf2001affb924f9ea78d25539c","unresolved":true,"context_lines":[{"line_number":63,"context_line":"###############################################################################"},{"line_number":64,"context_line":"# neutron/agent/linux/iptables_firewall.py"},{"line_number":65,"context_line":"#   \"ipset\", \"-A\", ..."},{"line_number":66,"context_line":"ipset: CommandFilter, ipset, root"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"###############################################################################"},{"line_number":69,"context_line":"# L3"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"a26df975_34cd7000","line":66,"in_reply_to":"b2440936_a923cb77","updated":"2021-03-31 07:11:02.000000000","message":"Right (actually I\u0027m working on this in another patch).\n\nI\u0027ll remove it now.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"fbc6fd1f596de0d85a839c4e69c030369251ca11","unresolved":true,"context_lines":[{"line_number":73,"context_line":"radvd: CommandFilter, radvd, root"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"# haproxy"},{"line_number":76,"context_line":"haproxy: RegExpFilter, haproxy, root, haproxy, -f, .*"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"# Keepalived"},{"line_number":79,"context_line":"keepalived: CommandFilter, keepalived, root"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ae65e2a_088120ec","line":76,"updated":"2021-03-31 06:52:36.000000000","message":"this is the same as L49. Do we want to have it duplicated? Maybe You could make section like \"Metadata proxy (used by L3 and DHCP agent)\" and put it there once","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"1382b39e08f42faf2001affb924f9ea78d25539c","unresolved":true,"context_lines":[{"line_number":73,"context_line":"radvd: CommandFilter, radvd, root"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"# haproxy"},{"line_number":76,"context_line":"haproxy: RegExpFilter, haproxy, root, haproxy, -f, .*"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"# Keepalived"},{"line_number":79,"context_line":"keepalived: CommandFilter, keepalived, root"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"38f34b1d_e011fb34","line":76,"in_reply_to":"1ae65e2a_088120ec","updated":"2021-03-31 07:11:02.000000000","message":"You are right. I\u0027ll create a section named medatada proxy","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"6d983cfeb14cfc076a3a877aa84a8ad0bbef1739","unresolved":true,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"# keepalived state change monitor"},{"line_number":82,"context_line":"keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"###############################################################################"},{"line_number":85,"context_line":"# OPEN VSWITCH"},{"line_number":86,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"eaeca3f7_58d80a4f","line":83,"updated":"2021-03-31 19:17:10.000000000","message":"why is neturon interacting with haproxy or keepalived?\n\nthis feels like it not somehting that neutron shoudl be doing.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"9e3719bab649be0ee8162e10668b179ca381316a","unresolved":true,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"# keepalived state change monitor"},{"line_number":82,"context_line":"keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"###############################################################################"},{"line_number":85,"context_line":"# OPEN VSWITCH"},{"line_number":86,"context_line":"###############################################################################"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"087110b9_a9c669b2","line":83,"in_reply_to":"eaeca3f7_58d80a4f","updated":"2021-03-31 20:14:37.000000000","message":"We spawn the keepalived process to handle the HA router instances, same as haproxy.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"fbc6fd1f596de0d85a839c4e69c030369251ca11","unresolved":true,"context_lines":[{"line_number":85,"context_line":"# OPEN VSWITCH"},{"line_number":86,"context_line":"###############################################################################"},{"line_number":87,"context_line":"# openvswitch-agent"},{"line_number":88,"context_line":"ovs-ofctl: CommandFilter, ovs-ofctl, root"},{"line_number":89,"context_line":"ovsdb-client: CommandFilter, ovsdb-client, root"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"4108c4ee_85908ee3","line":88,"updated":"2021-03-31 06:52:36.000000000","message":"is this one long running process?","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"1382b39e08f42faf2001affb924f9ea78d25539c","unresolved":true,"context_lines":[{"line_number":85,"context_line":"# OPEN VSWITCH"},{"line_number":86,"context_line":"###############################################################################"},{"line_number":87,"context_line":"# openvswitch-agent"},{"line_number":88,"context_line":"ovs-ofctl: CommandFilter, ovs-ofctl, root"},{"line_number":89,"context_line":"ovsdb-client: CommandFilter, ovsdb-client, root"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"a003d065_bbf08413","line":88,"in_reply_to":"4108c4ee_85908ee3","updated":"2021-03-31 07:11:02.000000000","message":"Not at all, I don\u0027t know why I thought that was the server itself...\n\nNOTE: I found that we didn\u0027t migrate ovs-ofctl to privsep.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"9e3719bab649be0ee8162e10668b179ca381316a","unresolved":true,"context_lines":[{"line_number":85,"context_line":"# OPEN VSWITCH"},{"line_number":86,"context_line":"###############################################################################"},{"line_number":87,"context_line":"# openvswitch-agent"},{"line_number":88,"context_line":"ovs-ofctl: CommandFilter, ovs-ofctl, root"},{"line_number":89,"context_line":"ovsdb-client: CommandFilter, ovsdb-client, root"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"a8b273c1_19c46626","line":88,"in_reply_to":"59a2f9d7_fc5a8076","updated":"2021-03-31 20:14:37.000000000","message":"There are some commands still using ofctl that are not supported with the native binding.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"6d983cfeb14cfc076a3a877aa84a8ad0bbef1739","unresolved":true,"context_lines":[{"line_number":85,"context_line":"# OPEN VSWITCH"},{"line_number":86,"context_line":"###############################################################################"},{"line_number":87,"context_line":"# openvswitch-agent"},{"line_number":88,"context_line":"ovs-ofctl: CommandFilter, ovs-ofctl, root"},{"line_number":89,"context_line":"ovsdb-client: CommandFilter, ovsdb-client, root"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"59a2f9d7_fc5a8076","line":88,"in_reply_to":"a003d065_bbf08413","updated":"2021-03-31 19:17:10.000000000","message":"you dont need to if you use the python binding and use tcp to connect.","commit_id":"3fdafbca6b96606015e726abc90f38544be6cc10"},{"author":{"_account_id":5948,"name":"Oleg Bondarev","email":"obondarev@mirantis.com","username":"obondarev"},"change_message_id":"d3f96f3b67cfcad8160348de1c8a2e608608626f","unresolved":true,"context_lines":[{"line_number":53,"context_line":"keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"# OPEN VSWITCH"},{"line_number":56,"context_line":"ovsdb-client: CommandFilter, ovsdb-client, root"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"96e5d8a9_f385865f","line":56,"updated":"2021-03-31 07:55:27.000000000","message":"You noted ovs-ofctl is not moved to privsep, should it be here then?","commit_id":"d3521db5a031c3499edab90a54d0a66cbceead0c"},{"author":{"_account_id":5948,"name":"Oleg Bondarev","email":"obondarev@mirantis.com","username":"obondarev"},"change_message_id":"8b069c243eeb6021d1e9d7ebf3a31163d4137f8a","unresolved":true,"context_lines":[{"line_number":53,"context_line":"keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"# OPEN VSWITCH"},{"line_number":56,"context_line":"ovsdb-client: CommandFilter, ovsdb-client, root"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"116ec75a_2ea5f1ac","line":56,"in_reply_to":"05f9ce7c_80597ede","updated":"2021-03-31 08:18:10.000000000","message":"Right, I missed it, thanks","commit_id":"d3521db5a031c3499edab90a54d0a66cbceead0c"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"04db28bde75a813ebfa938125d8617feb8a3b12c","unresolved":true,"context_lines":[{"line_number":53,"context_line":"keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"# OPEN VSWITCH"},{"line_number":56,"context_line":"ovsdb-client: CommandFilter, ovsdb-client, root"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"05f9ce7c_80597ede","line":56,"in_reply_to":"96e5d8a9_f385865f","updated":"2021-03-31 08:12:14.000000000","message":"this patch is now on top of https://review.opendev.org/c/openstack/neutron/+/784013/ which moves it to privsep. So I think it\u0027s ok now.","commit_id":"d3521db5a031c3499edab90a54d0a66cbceead0c"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"d9386979304490c184125c17c654224c9313548e","unresolved":true,"context_lines":[{"line_number":45,"context_line":"dnsmasq: CommandFilter, dnsmasq, root"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"# DIBBLER"},{"line_number":48,"context_line":"dibbler-client: CommandFilter, dibbler-client, root"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"# L3"},{"line_number":51,"context_line":"radvd: CommandFilter, radvd, root"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"4779fa55_f49b970f","line":48,"updated":"2021-04-06 10:25:47.000000000","message":"strictly speaking this could be in the L3 section below but it\u0027s ok like it\u0027s now too :)","commit_id":"be6ee6f397124dbf076cbad9f93b6ac5cb67facf"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"7055bee9cd84028a51dd87ccbba6132d6960c381","unresolved":true,"context_lines":[{"line_number":45,"context_line":"dnsmasq: CommandFilter, dnsmasq, root"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"# DIBBLER"},{"line_number":48,"context_line":"dibbler-client: CommandFilter, dibbler-client, root"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"# L3"},{"line_number":51,"context_line":"radvd: CommandFilter, radvd, root"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"455a1c6c_99813f1f","line":48,"in_reply_to":"4779fa55_f49b970f","updated":"2021-04-07 16:57:38.000000000","message":"Right. I keep it here because we had a specific file only for it.\n\nBTW, we need to start thinking about the replacement/migration to another tool.","commit_id":"be6ee6f397124dbf076cbad9f93b6ac5cb67facf"}]}