)]}'
{"etc/nova/rootwrap.d/compute.filters":[{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"254b73b7813d3f31c53fc05ab4e9f2be72fbc7a7","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"privsep-rootwrap-dacnet_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.dacnet_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"# nova/virt/libvirt/storage/dmcrypt.py:"},{"line_number":205,"context_line":"cryptsetup: CommandFilter, cryptsetup, root"}],"source_content_type":"application/octet-stream","patch_set":29,"id":"7f287b81_5d854e59","line":202,"updated":"2017-09-07 13:32:05.000000000","message":"Any time new rules are coming in, we\u0027re going to need a reno. Also it should be explained why a bit more clearly in the commit message so that on git log -S we\u0027ll have more history here.","commit_id":"c9ebbf197272018e67d4305b436ef0f6cc29ce4b"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"63aaf4769e5c7af16561969f8722333bc4d43cf2","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"privsep-rootwrap-dacnet_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.dacnet_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"# nova/virt/libvirt/storage/dmcrypt.py:"},{"line_number":205,"context_line":"cryptsetup: CommandFilter, cryptsetup, root"}],"source_content_type":"application/octet-stream","patch_set":29,"id":"7f287b81_3104e649","line":202,"in_reply_to":"7f287b81_5d854e59","updated":"2017-09-07 17:15:15.000000000","message":"Done","commit_id":"c9ebbf197272018e67d4305b436ef0f6cc29ce4b"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"254b73b7813d3f31c53fc05ab4e9f2be72fbc7a7","unresolved":false,"context_lines":[{"line_number":202,"context_line":"privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"# nova/virt/libvirt/storage/dmcrypt.py:"},{"line_number":205,"context_line":"cryptsetup: CommandFilter, cryptsetup, root"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"# nova/virt/xenapi/vm_utils.py:"},{"line_number":208,"context_line":"xenstore-read: CommandFilter, xenstore-read, root"}],"source_content_type":"application/octet-stream","patch_set":29,"id":"7f287b81_1d7b467b","line":205,"updated":"2017-09-07 13:32:05.000000000","message":"I don\u0027t understand why this is here at all","commit_id":"c9ebbf197272018e67d4305b436ef0f6cc29ce4b"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"63aaf4769e5c7af16561969f8722333bc4d43cf2","unresolved":false,"context_lines":[{"line_number":202,"context_line":"privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"# nova/virt/libvirt/storage/dmcrypt.py:"},{"line_number":205,"context_line":"cryptsetup: CommandFilter, cryptsetup, root"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"# nova/virt/xenapi/vm_utils.py:"},{"line_number":208,"context_line":"xenstore-read: CommandFilter, xenstore-read, root"}],"source_content_type":"application/octet-stream","patch_set":29,"id":"7f287b81_71e6eeb2","line":205,"in_reply_to":"7f287b81_1d7b467b","updated":"2017-09-07 17:15:15.000000000","message":"This was a rebase error from re-ordering the patches I think. Fixed.","commit_id":"c9ebbf197272018e67d4305b436ef0f6cc29ce4b"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"7ad2f4fff4ccf498ef717effff9696dfc01d670c","unresolved":false,"context_lines":[{"line_number":197,"context_line":""},{"line_number":198,"context_line":"privsep-rootwrap-dac_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.dac_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"privsep-rootwrap-dacnet_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.dacnet_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\\.\\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.*"},{"line_number":203,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":31,"id":"5f2577a7_201ad07c","line":200,"updated":"2017-09-11 15:50:28.000000000","message":"Move this earlier. Done.","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"}],"nova/privsep/__init__.py":[{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"cc1346692de7f4bc59a460cf279c2e9f1a0b10d1","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    \u0027nova\u0027,"},{"line_number":47,"context_line":"    cfg_section\u003d\u0027nova_privileged\u0027,"},{"line_number":48,"context_line":"    pypath\u003d__name__ + \u0027sys_admin_pctxt\u0027,"},{"line_number":49,"context_line":"    capabilities\u003d[capabilities.CAP_SYS_ADMIN],"},{"line_number":50,"context_line":")"}],"source_content_type":"text/x-python","patch_set":16,"id":"9f436f4f_0154e81f","line":49,"range":{"start_line":49,"start_character":18,"end_line":49,"end_character":44},"updated":"2017-08-15 01:51:20.000000000","message":"If you really want this to be like sudo you\u0027ll want to do something like:\n\n capabilities\u003d[range(0, 38)]\n\nWhich would match your not-very granular statement.","commit_id":"04e2b71aae76b65696232c62bc06293557f4ab44"},{"author":{"_account_id":11279,"name":"Angus Lees","email":"gus@inodes.org","username":"gus"},"change_message_id":"fa67f7681246cfb2f65ae2a759215d534614381a","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    \u0027nova\u0027,"},{"line_number":47,"context_line":"    cfg_section\u003d\u0027nova_privileged\u0027,"},{"line_number":48,"context_line":"    pypath\u003d__name__ + \u0027sys_admin_pctxt\u0027,"},{"line_number":49,"context_line":"    capabilities\u003d[capabilities.CAP_SYS_ADMIN],"},{"line_number":50,"context_line":")"}],"source_content_type":"text/x-python","patch_set":16,"id":"9f436f4f_5315f83e","line":49,"range":{"start_line":49,"start_character":18,"end_line":49,"end_character":44},"in_reply_to":"9f436f4f_0154e81f","updated":"2017-08-16 10:59:16.000000000","message":"The hard thing about adding unnecessary capabilities is that it\u0027s almost impossible to convince yourself (and 2 other core reviewers) when it\u0027s safe to remove them again...","commit_id":"04e2b71aae76b65696232c62bc06293557f4ab44"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"f236c68f1b1585f2f4d5f7b5199bb21ee47643de","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    \u0027nova\u0027,"},{"line_number":47,"context_line":"    cfg_section\u003d\u0027nova_privileged\u0027,"},{"line_number":48,"context_line":"    pypath\u003d__name__ + \u0027sys_admin_pctxt\u0027,"},{"line_number":49,"context_line":"    capabilities\u003d[capabilities.CAP_SYS_ADMIN],"},{"line_number":50,"context_line":")"}],"source_content_type":"text/x-python","patch_set":16,"id":"9f436f4f_76cf9429","line":49,"range":{"start_line":49,"start_character":18,"end_line":49,"end_character":44},"in_reply_to":"9f436f4f_5315f83e","updated":"2017-08-18 06:34:17.000000000","message":"Yup.  I\u0027m not really advocating for him to do that thing just pointing out the disconnect between the comment and the implementation.\n\nAs you can see later I convinced myself the cap_sys_admin isn\u0027t needed for reading ptys at all","commit_id":"04e2b71aae76b65696232c62bc06293557f4ab44"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"19e3e13403187fbef29a22ed4af40f85bbf76652","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    \u0027nova\u0027,"},{"line_number":47,"context_line":"    cfg_section\u003d\u0027nova_sys_admin\u0027,"},{"line_number":48,"context_line":"    pypath\u003d__name__ + \u0027.sys_admin_pctxt\u0027,"},{"line_number":49,"context_line":"    capabilities\u003d[capabilities.CAP_SYS_ADMIN],"},{"line_number":50,"context_line":")"}],"source_content_type":"text/x-python","patch_set":19,"id":"9f436f4f_efbd2fb7","line":49,"range":{"start_line":49,"start_character":18,"end_line":49,"end_character":44},"updated":"2017-08-15 22:24:13.000000000","message":"You shoudl probably include dac_admin capabilities here to avoid issues like: http://logs.openstack.org/86/489486/19/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/2ec7294/logs/screen-n-cpu.txt.gz#_Aug_15_07_25_23_907713\n\nIn fact:\n\n [tony@thor linux]$ git grep CAP_* fs/devpts fs/namei.c\n fs/namei.c:345:                                              CAP_DAC_READ_SEARCH))\n fs/namei.c:347:         if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))\n fs/namei.c:357:         if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))\n fs/namei.c:365:         if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))\n fs/namei.c:911: * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is\n fs/namei.c:995: *  - not CAP_FOWNER in a namespace with the inode owner uid mapped\n fs/namei.c:1008:        /* Source inode owner (or CAP_FOWNER) can hardlink all they like,\n fs/namei.c:2753:        return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);\n fs/namei.c:2767: *      c. have CAP_FOWNER capability\n fs/namei.c:3695:        if ((S_ISCHR(mode) || S_ISBLK(mode)) \u0026\u0026 !capable(CAP_MKNOD))\n fs/namei.c:4252:         * To use null names we require CAP_DAC_READ_SEARCH\n fs/namei.c:4257:                if (!capable(CAP_DAC_READ_SEARCH))\n fs/namei.c:4507:        if ((flags \u0026 RENAME_WHITEOUT) \u0026\u0026 !capable(CAP_MKNOD))\n\n\nimplies that dac_admin is all that\u0027s needed to read from the console pty.  We can ignore the CAP_MKNOD as we never (i hop) need to make console device nodes ;P","commit_id":"aa9309ed6d774e05a4776bd95c5decaff1e4e599"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"e3ae71bb920a61b5f7c0606f7d2722b63d6e7a9f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"#              can bypass permissions checks in the file-system."},{"line_number":23,"context_line":"dac_admin_pctxt \u003d priv_context.PrivContext("},{"line_number":24,"context_line":"    \u0027nova\u0027,"},{"line_number":25,"context_line":"    cfg_section\u003d\u0027nova_dac_admin\u0027,"},{"line_number":26,"context_line":"    pypath\u003d__name__ + \u0027.dac_admin_pctxt\u0027,"},{"line_number":27,"context_line":"    # NOTE(tonyb): These map to CAP_CHOWN, CAP_DAC_OVERRIDE,"},{"line_number":28,"context_line":"    #              CAP_DAC_READ_SEARCH  and CAP_FOWNER.  Some do not have"}],"source_content_type":"text/x-python","patch_set":31,"id":"5f2577a7_878767d8","line":25,"range":{"start_line":25,"start_character":4,"end_line":25,"end_character":15},"updated":"2017-09-10 18:25:08.000000000","message":"These should be done earlier.","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"7ad2f4fff4ccf498ef717effff9696dfc01d670c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"#              can bypass permissions checks in the file-system."},{"line_number":23,"context_line":"dac_admin_pctxt \u003d priv_context.PrivContext("},{"line_number":24,"context_line":"    \u0027nova\u0027,"},{"line_number":25,"context_line":"    cfg_section\u003d\u0027nova_dac_admin\u0027,"},{"line_number":26,"context_line":"    pypath\u003d__name__ + \u0027.dac_admin_pctxt\u0027,"},{"line_number":27,"context_line":"    # NOTE(tonyb): These map to CAP_CHOWN, CAP_DAC_OVERRIDE,"},{"line_number":28,"context_line":"    #              CAP_DAC_READ_SEARCH  and CAP_FOWNER.  Some do not have"}],"source_content_type":"text/x-python","patch_set":31,"id":"5f2577a7_805ce44b","line":25,"range":{"start_line":25,"start_character":4,"end_line":25,"end_character":15},"in_reply_to":"5f2577a7_878767d8","updated":"2017-09-11 15:50:28.000000000","message":"Done","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"e3ae71bb920a61b5f7c0606f7d2722b63d6e7a9f","unresolved":false,"context_lines":[{"line_number":35,"context_line":"# NOTE(mikal): DAC + CAP_NET_ADMIN, required for network sysfs changes"},{"line_number":36,"context_line":"dacnet_admin_pctxt \u003d priv_context.PrivContext("},{"line_number":37,"context_line":"    \u0027nova\u0027,"},{"line_number":38,"context_line":"    cfg_section\u003d\u0027nova_dacnet_admin\u0027,"},{"line_number":39,"context_line":"    pypath\u003d__name__ + \u0027.dacnet_admin_pctxt\u0027,"},{"line_number":40,"context_line":"    capabilities\u003d[0, 1, 2, 3, capabilities.CAP_NET_ADMIN],"},{"line_number":41,"context_line":")"}],"source_content_type":"text/x-python","patch_set":31,"id":"5f2577a7_47697f23","line":38,"range":{"start_line":38,"start_character":4,"end_line":38,"end_character":15},"updated":"2017-09-10 18:25:08.000000000","message":"And this one.","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"7ad2f4fff4ccf498ef717effff9696dfc01d670c","unresolved":false,"context_lines":[{"line_number":35,"context_line":"# NOTE(mikal): DAC + CAP_NET_ADMIN, required for network sysfs changes"},{"line_number":36,"context_line":"dacnet_admin_pctxt \u003d priv_context.PrivContext("},{"line_number":37,"context_line":"    \u0027nova\u0027,"},{"line_number":38,"context_line":"    cfg_section\u003d\u0027nova_dacnet_admin\u0027,"},{"line_number":39,"context_line":"    pypath\u003d__name__ + \u0027.dacnet_admin_pctxt\u0027,"},{"line_number":40,"context_line":"    capabilities\u003d[0, 1, 2, 3, capabilities.CAP_NET_ADMIN],"},{"line_number":41,"context_line":")"}],"source_content_type":"text/x-python","patch_set":31,"id":"5f2577a7_6059f858","line":38,"range":{"start_line":38,"start_character":4,"end_line":38,"end_character":15},"in_reply_to":"5f2577a7_47697f23","updated":"2017-09-11 15:50:28.000000000","message":"Done","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"e3ae71bb920a61b5f7c0606f7d2722b63d6e7a9f","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    capabilities\u003d[0, 1, 2, 3, capabilities.CAP_NET_ADMIN],"},{"line_number":41,"context_line":")"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"# NOTE(mikal): this context is not very granular. Use one of the others"},{"line_number":44,"context_line":"# instead unless you have a really good reason."},{"line_number":45,"context_line":"sys_admin_pctxt \u003d priv_context.PrivContext("},{"line_number":46,"context_line":"    \u0027nova\u0027,"}],"source_content_type":"text/x-python","patch_set":31,"id":"5f2577a7_a78263c7","line":43,"updated":"2017-09-10 18:25:08.000000000","message":"This either needs to get added earlier in the series, or we need to not add it to rootwrap until now.","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"7ad2f4fff4ccf498ef717effff9696dfc01d670c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    capabilities\u003d[0, 1, 2, 3, capabilities.CAP_NET_ADMIN],"},{"line_number":41,"context_line":")"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"# NOTE(mikal): this context is not very granular. Use one of the others"},{"line_number":44,"context_line":"# instead unless you have a really good reason."},{"line_number":45,"context_line":"sys_admin_pctxt \u003d priv_context.PrivContext("},{"line_number":46,"context_line":"    \u0027nova\u0027,"}],"source_content_type":"text/x-python","patch_set":31,"id":"5f2577a7_2031b00c","line":43,"in_reply_to":"5f2577a7_a78263c7","updated":"2017-09-11 15:50:28.000000000","message":"Done","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"}],"nova/privsep/dac_admin.py":[{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"cac9a3370857f4a42bb5ef8a46ed69c036d5f338","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\"\"\"Routines that use the dac_admin_pctxt to bypass file-system checks\"\"\""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"import fcntl"},{"line_number":19,"context_line":"import os"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"df3967d1_da7e1518","line":18,"updated":"2017-08-02 05:03:06.000000000","message":"I think this will make hyper-V sad as fnctl isn\u0027t a think there.","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"d2c457e15d6d2af1df07483f0535c335195cbe2f","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\"\"\"Routines that use the dac_admin_pctxt to bypass file-system checks\"\"\""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"import fcntl"},{"line_number":19,"context_line":"import os"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"df3967d1_d1b5dbce","line":18,"in_reply_to":"df3967d1_da7e1518","updated":"2017-08-02 06:41:00.000000000","message":"Ugh, really? Sigh.","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"}],"nova/privsep/libvirt.py":[{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"96617adb3187794eab9df69cd4f4dde13a23b1ff","unresolved":false,"context_lines":[{"line_number":191,"context_line":"    except Exception as e:"},{"line_number":192,"context_line":"        # NOTE(mikal): dear internet, I see you looking at me with your"},{"line_number":193,"context_line":"        # judging eyes. There\u0027s a story behind why we do this. You see, the"},{"line_number":194,"context_line":"        # previous implementation did this:"},{"line_number":195,"context_line":"        #"},{"line_number":196,"context_line":"        # out, err \u003d utils.execute(\u0027dd\u0027,"},{"line_number":197,"context_line":"        #                          \u0027if\u003d%s\u0027 % pty,"}],"source_content_type":"text/x-python","patch_set":35,"id":"7f515b1d_94fe7b69","line":194,"updated":"2017-10-04 10:51:54.000000000","message":"I will now have to judge you for other reasons","commit_id":"a0235b187a87c53d113871f7a0d0ea9781fffba3"}],"nova/virt/libvirt/driver.py":[{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"cac9a3370857f4a42bb5ef8a46ed69c036d5f338","unresolved":false,"context_lines":[{"line_number":2884,"context_line":"            raise exception.ConsoleNotAvailable()"},{"line_number":2885,"context_line":""},{"line_number":2886,"context_line":"        console_log \u003d self._get_console_log_path(instance)"},{"line_number":2887,"context_line":"        data \u003d dac_admin.readfile(pty, nonblocking\u003dTrue)"},{"line_number":2888,"context_line":""},{"line_number":2889,"context_line":"        # NOTE(markus_z): The virt_types kvm and qemu are the only ones"},{"line_number":2890,"context_line":"        # which create a dedicated file device for the console logging."}],"source_content_type":"text/x-python","patch_set":5,"id":"df3967d1_9a22cdff","line":2887,"range":{"start_line":2887,"start_character":34,"end_line":2887,"end_character":37},"updated":"2017-08-02 05:03:06.000000000","message":"I have a poorly formed misgiving about this.  I\u0027m not 100% certain that we can just read a pty like that.  It\u0027d be interesting to see how dd behaves (at the syscall layer) and confirm dac_admin.readfile() does the same thing","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"51ac948ead3b7f6a0b9b39224b8a82e129d12b95","unresolved":false,"context_lines":[{"line_number":2884,"context_line":"            raise exception.ConsoleNotAvailable()"},{"line_number":2885,"context_line":""},{"line_number":2886,"context_line":"        console_log \u003d self._get_console_log_path(instance)"},{"line_number":2887,"context_line":"        data \u003d dac_admin.readfile(pty, nonblocking\u003dTrue)"},{"line_number":2888,"context_line":""},{"line_number":2889,"context_line":"        # NOTE(markus_z): The virt_types kvm and qemu are the only ones"},{"line_number":2890,"context_line":"        # which create a dedicated file device for the console logging."}],"source_content_type":"text/x-python","patch_set":5,"id":"9f436f4f_81d338d5","line":2887,"range":{"start_line":2887,"start_character":34,"end_line":2887,"end_character":37},"in_reply_to":"9f436f4f_86fb6a45","updated":"2017-08-15 00:50:33.000000000","message":"Yeah.  I was referring to what oslo.privsep does today.  I know it\u0027s possible just a small matter of code ;P","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"},{"author":{"_account_id":11279,"name":"Angus Lees","email":"gus@inodes.org","username":"gus"},"change_message_id":"264c7361158b7171a3299fafcedab9ccde94da1f","unresolved":false,"context_lines":[{"line_number":2884,"context_line":"            raise exception.ConsoleNotAvailable()"},{"line_number":2885,"context_line":""},{"line_number":2886,"context_line":"        console_log \u003d self._get_console_log_path(instance)"},{"line_number":2887,"context_line":"        data \u003d dac_admin.readfile(pty, nonblocking\u003dTrue)"},{"line_number":2888,"context_line":""},{"line_number":2889,"context_line":"        # NOTE(markus_z): The virt_types kvm and qemu are the only ones"},{"line_number":2890,"context_line":"        # which create a dedicated file device for the console logging."}],"source_content_type":"text/x-python","patch_set":5,"id":"9f436f4f_86fb6a45","line":2887,"range":{"start_line":2887,"start_character":34,"end_line":2887,"end_character":37},"in_reply_to":"df3967d1_3e8cd034","updated":"2017-08-14 02:43:35.000000000","message":"\u003e We can\u0027t pass fd\u0027s across the privsep boundry so we\u0027d also need do the read there too.\n\nWe can - if we implement that, fwiw.  It\u0027s a semi-frequently requested privsep feature and an obvious addition to the current abstraction.  So far there hasn\u0027t been a need strong enough to actually do the day-or-so of work that it would take.","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"0dee7e5dc87e979f6d795210e9983ba17fbd38be","unresolved":false,"context_lines":[{"line_number":2884,"context_line":"            raise exception.ConsoleNotAvailable()"},{"line_number":2885,"context_line":""},{"line_number":2886,"context_line":"        console_log \u003d self._get_console_log_path(instance)"},{"line_number":2887,"context_line":"        data \u003d dac_admin.readfile(pty, nonblocking\u003dTrue)"},{"line_number":2888,"context_line":""},{"line_number":2889,"context_line":"        # NOTE(markus_z): The virt_types kvm and qemu are the only ones"},{"line_number":2890,"context_line":"        # which create a dedicated file device for the console logging."}],"source_content_type":"text/x-python","patch_set":5,"id":"df3967d1_3e8cd034","line":2887,"range":{"start_line":2887,"start_character":34,"end_line":2887,"end_character":37},"in_reply_to":"df3967d1_8465cfe3","updated":"2017-08-03 01:03:59.000000000","message":"The more I think about it the more I think we should create a dac_admin  function that uses os.open() and passes os.O_RDONLY|os.O_NONBLOCK as flags.  This would avoid the awkward fnctl() issue on hyper-v and is probably closer to what dd will be doing.\n\nWe can\u0027t pass fd\u0027s across the privsep boundry so we\u0027d also need do the read there too.","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"cce86625c1c0fe2687cb2d48cd8d37811de71b44","unresolved":false,"context_lines":[{"line_number":2884,"context_line":"            raise exception.ConsoleNotAvailable()"},{"line_number":2885,"context_line":""},{"line_number":2886,"context_line":"        console_log \u003d self._get_console_log_path(instance)"},{"line_number":2887,"context_line":"        data \u003d dac_admin.readfile(pty, nonblocking\u003dTrue)"},{"line_number":2888,"context_line":""},{"line_number":2889,"context_line":"        # NOTE(markus_z): The virt_types kvm and qemu are the only ones"},{"line_number":2890,"context_line":"        # which create a dedicated file device for the console logging."}],"source_content_type":"text/x-python","patch_set":5,"id":"df3967d1_8465cfe3","line":2887,"range":{"start_line":2887,"start_character":34,"end_line":2887,"end_character":37},"in_reply_to":"df3967d1_91ccf361","updated":"2017-08-02 07:04:11.000000000","message":"Sure, but not this week","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"d2c457e15d6d2af1df07483f0535c335195cbe2f","unresolved":false,"context_lines":[{"line_number":2884,"context_line":"            raise exception.ConsoleNotAvailable()"},{"line_number":2885,"context_line":""},{"line_number":2886,"context_line":"        console_log \u003d self._get_console_log_path(instance)"},{"line_number":2887,"context_line":"        data \u003d dac_admin.readfile(pty, nonblocking\u003dTrue)"},{"line_number":2888,"context_line":""},{"line_number":2889,"context_line":"        # NOTE(markus_z): The virt_types kvm and qemu are the only ones"},{"line_number":2890,"context_line":"        # which create a dedicated file device for the console logging."}],"source_content_type":"text/x-python","patch_set":5,"id":"df3967d1_91ccf361","line":2887,"range":{"start_line":2887,"start_character":34,"end_line":2887,"end_character":37},"in_reply_to":"df3967d1_9a22cdff","updated":"2017-08-02 06:41:00.000000000","message":"I vote you read the kernel for me, oh pair programming buddy.","commit_id":"7f1982f459c814658fafb40aaa4837ada82c6818"}],"releasenotes/notes/privsep-queens-rootwrap-adds-907aa1bc8e3eb2ca.yaml":[{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"e3ae71bb920a61b5f7c0606f7d2722b63d6e7a9f","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    A dac-admin privsep daemon has been added and needs to be included in your"},{"line_number":5,"context_line":"    rootwrap configuration."},{"line_number":6,"context_line":"  - |"},{"line_number":7,"context_line":"    A dacnet-admin privsep daemon has been added and needs to be included in"},{"line_number":8,"context_line":"    your rootwrap configuration."},{"line_number":9,"context_line":"  - |"},{"line_number":10,"context_line":"    A sys_admin privsep daemon has been added and needs to be included in your"}],"source_content_type":"text/x-yaml","patch_set":31,"id":"5f2577a7_c7668f52","line":7,"updated":"2017-09-10 18:25:08.000000000","message":"And then update this to whatever I did with the other bits I wanted to move earlier.","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"7ad2f4fff4ccf498ef717effff9696dfc01d670c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    A dac-admin privsep daemon has been added and needs to be included in your"},{"line_number":5,"context_line":"    rootwrap configuration."},{"line_number":6,"context_line":"  - |"},{"line_number":7,"context_line":"    A dacnet-admin privsep daemon has been added and needs to be included in"},{"line_number":8,"context_line":"    your rootwrap configuration."},{"line_number":9,"context_line":"  - |"},{"line_number":10,"context_line":"    A sys_admin privsep daemon has been added and needs to be included in your"}],"source_content_type":"text/x-yaml","patch_set":31,"id":"5f2577a7_cb268db8","line":7,"in_reply_to":"5f2577a7_c7668f52","updated":"2017-09-11 15:50:28.000000000","message":"Done","commit_id":"794851eb9b665b8fff1843759e12ab1f2b8247e2"}]}