)]}'
{"etc/nova/rootwrap.d/compute.filters":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9d617e2efb82ce64b16f247cd4a41de37ece95d5","unresolved":false,"context_lines":[{"line_number":217,"context_line":"# os_brick.privileged.default oslo.privsep context"},{"line_number":218,"context_line":"# This line ties the superuser privs with the config files, context name,"},{"line_number":219,"context_line":"# and (implicitly) the actual python code invoked."},{"line_number":220,"context_line":"privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"# nova/storage/linuxscsi.py: sg_scan device"},{"line_number":223,"context_line":"sg_scan: CommandFilter, sg_scan, root"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1af94dfe_fee1262b","line":220,"range":{"start_line":220,"start_character":104,"end_line":220,"end_character":119},"updated":"2016-03-18 18:42:00.000000000","message":"Looking at the privsep code, privsep_context is a single entry:\n\nhttps://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/daemon.py#L485\n\nWon\u0027t that have to handle multiple entries (list or multistr opt) for when we have os_vif.privileged.default?","commit_id":"18129874cdc745b05b35d61b1c1979566453ca13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5915c682e50b2983b6d4d1028acf2264f8599078","unresolved":false,"context_lines":[{"line_number":217,"context_line":"# os_brick.privileged.default oslo.privsep context"},{"line_number":218,"context_line":"# This line ties the superuser privs with the config files, context name,"},{"line_number":219,"context_line":"# and (implicitly) the actual python code invoked."},{"line_number":220,"context_line":"privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"# nova/storage/linuxscsi.py: sg_scan device"},{"line_number":223,"context_line":"sg_scan: CommandFilter, sg_scan, root"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1af94dfe_cab3c94b","line":220,"range":{"start_line":220,"start_character":121,"end_line":220,"end_character":148},"updated":"2016-03-18 18:14:57.000000000","message":"What happens when we have to add this for os-vif also?","commit_id":"18129874cdc745b05b35d61b1c1979566453ca13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5915c682e50b2983b6d4d1028acf2264f8599078","unresolved":false,"context_lines":[{"line_number":217,"context_line":"# os_brick.privileged.default oslo.privsep context"},{"line_number":218,"context_line":"# This line ties the superuser privs with the config files, context name,"},{"line_number":219,"context_line":"# and (implicitly) the actual python code invoked."},{"line_number":220,"context_line":"privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"# nova/storage/linuxscsi.py: sg_scan device"},{"line_number":223,"context_line":"sg_scan: CommandFilter, sg_scan, root"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1af94dfe_0a2c9197","line":220,"updated":"2016-03-18 18:14:57.000000000","message":"Where does this get called/used?","commit_id":"18129874cdc745b05b35d61b1c1979566453ca13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"232bc6866409d137d240595ab0722e8feddbea13","unresolved":false,"context_lines":[{"line_number":217,"context_line":"# os_brick.privileged.default oslo.privsep context"},{"line_number":218,"context_line":"# This line ties the superuser privs with the config files, context name,"},{"line_number":219,"context_line":"# and (implicitly) the actual python code invoked."},{"line_number":220,"context_line":"privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"# nova/storage/linuxscsi.py: sg_scan device"},{"line_number":223,"context_line":"sg_scan: CommandFilter, sg_scan, root"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1af94dfe_be0afe23","line":220,"in_reply_to":"1af94dfe_0a2c9197","updated":"2016-03-18 19:05:36.000000000","message":"If I\u0027m reading this correctly, the privsep-helper is used here:\n\nhttp://git.openstack.org/cgit/openstack/oslo.privsep/tree/oslo_privsep/daemon.py#n338\n\nAnd the helper_command is defined in nova.conf, which is provided, and set in the devstack change here:\n\nhttps://review.openstack.org/#/c/277696/3/lib/nova\n\nIt all seems a bit like a circular-dependency, unless I\u0027m not following this correctly.\n\nJust trying to understand this some more before we land it.","commit_id":"18129874cdc745b05b35d61b1c1979566453ca13"},{"author":{"_account_id":11279,"name":"Angus Lees","email":"gus@inodes.org","username":"gus"},"change_message_id":"6ce7fbfcc905c89370ccf9d8d143ef65e02fb8b6","unresolved":false,"context_lines":[{"line_number":217,"context_line":"# os_brick.privileged.default oslo.privsep context"},{"line_number":218,"context_line":"# This line ties the superuser privs with the config files, context name,"},{"line_number":219,"context_line":"# and (implicitly) the actual python code invoked."},{"line_number":220,"context_line":"privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"# nova/storage/linuxscsi.py: sg_scan device"},{"line_number":223,"context_line":"sg_scan: CommandFilter, sg_scan, root"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa0719c6_4f54ad53","line":220,"in_reply_to":"1af94dfe_be0afe23","updated":"2016-03-20 23:25:18.000000000","message":"Yes, this command is invoked in the depths of oslo.privsep, in response to the singleton created/configured in os-brick here: https://review.openstack.org/#/c/277224/21/os_brick/privileged/__init__.py\n\nIt is expected that most \"projects\" that use oslo.privsep will want their privileged code running with a different set of privileges/uids, and so there will probably be several (I\u0027d guess ~3) lines like the above in a diverse project like nova.  These lines will each have a different --privsep_context (and I think rootwrap also requires the first field to be unique, but it is otherwise ignored).\n\nThe abstract purpose of the line above is for the administrator to declare that:\n- a particular collection of python code (python environment used for the privsep-helper command) and\n- oslo.config configuration (--config-file)\n- is secure (writable by root only) and trusted to be run with elevated privileges (as granted by rootwrap in this example)\n- and provide access to the functions/permissions defined by the --privsep_context defined in that python code and config.\n\nThe big difference from rootwrap that you can see here is that in rootwrap the exact command lines to be \"trusted\" had to be repeated in rootwrap filters _and_ in the python code that generated the command lines.  In privsep, the \"trust\" is delegated to the trusted python import path.\n\nI think the \"circular dependency\" tingling in your spider sense is the two paths (python singleton, and rootwrap filter entry) that both repeat the combination of code and context name.  Unfortunately this is required because we start nova (and other openstack services) with zero privileges and expect them to magically gain them via sudo/rootwrap halfway through the callstack.  This necessarily requires a somewhat-duplicated sudo/rootwrap config somewhere with a narrow definition of what should be allowed, because you wouldn\u0027t want just any code to be able to gain root in this way.  Security exploits abound because it is hard to make these two descriptions match - see the \"chmod\" entry earlier in this rootwrap filters file for an example that can be trivially exploited.  If you\u0027re curious, an alternative to all of this is the usual Unix model of _starting_ a daemon with all required permissions, doing setup, and then dropping privileges before processing queries - if we were to migrate nova to this method of invocation, then we wouldn\u0027t need the above rootwrap entry (nor sudo) at all.  oslo.privsep allows us to move to that usual Unix model, if anyone would like to make changes to the way nova is deployed ;)\n\nI encourage you to read the oslo.privsep spec if you haven\u0027t already, since it is the best place for an overview of how the pieces fit together (or at least if it isn\u0027t clear there, then we should fix that).","commit_id":"18129874cdc745b05b35d61b1c1979566453ca13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d47d05546b6d3ee763b24d086b2efb677b1c3204","unresolved":false,"context_lines":[{"line_number":217,"context_line":"# os_brick.privileged.default oslo.privsep context"},{"line_number":218,"context_line":"# This line ties the superuser privs with the config files, context name,"},{"line_number":219,"context_line":"# and (implicitly) the actual python code invoked."},{"line_number":220,"context_line":"privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"# nova/storage/linuxscsi.py: sg_scan device"},{"line_number":223,"context_line":"sg_scan: CommandFilter, sg_scan, root"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa0719c6_9eec88f4","line":220,"in_reply_to":"fa0719c6_4f54ad53","updated":"2016-03-23 21:37:00.000000000","message":"Thanks, this plus the response in the mailing list helps:\n\nhttp://lists.openstack.org/pipermail/openstack-dev/2016-March/090172.html\n\nAs for the spec, I tried to read through most of it, but my eyes started to glaze over before really getting into implementation details. So probably the reason I was really asking about a lot of this here (in this dependency chain series anyway) is that there is this actual series of patches with examples, so it\u0027s easier to form in my head how they are related.","commit_id":"18129874cdc745b05b35d61b1c1979566453ca13"}]}