)]}'
{"specs/juno/rootwrap-daemon-mode.rst":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Daemon starting"},{"line_number":28,"context_line":"---------------"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Daemon will be started using a separate binary (like neutron-rootwrap-daemon"},{"line_number":31,"context_line":"for Neutron) pointing to ``oslo.rootwrap.cmd:daemon`` endpoint (instead of"},{"line_number":32,"context_line":"``:main``). The binary will receive the same options as the normal one except"},{"line_number":33,"context_line":"the command to be run in priviledged mode."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_73763b08","line":30,"updated":"2014-05-21 22:13:41.000000000","message":"If we\u0027re going to have to pass the daemon the name of its configuration file anyway, should we just create a single daemon executable as part of the library\u0027s installation?","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"f90392a1aa5515bee6a3c6deecb1d36f974f9d3d","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Daemon starting"},{"line_number":28,"context_line":"---------------"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Daemon will be started using a separate binary (like neutron-rootwrap-daemon"},{"line_number":31,"context_line":"for Neutron) pointing to ``oslo.rootwrap.cmd:daemon`` endpoint (instead of"},{"line_number":32,"context_line":"``:main``). The binary will receive the same options as the normal one except"},{"line_number":33,"context_line":"the command to be run in priviledged mode."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_a51cee14","line":30,"in_reply_to":"7adec928_73763b08","updated":"2014-05-22 07:31:02.000000000","message":"oslo.rootwrap doesn\u0027t provide any binaries currently. I don\u0027t know the story behind this decision but I guess if we\u0027re going to switch to smth like \"rootwrap\" and \"rootwrap-daemon\" it should be done simultaneously and out of scope for this blueprint.","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The startup process is the same as in normal mode up to the point when the"},{"line_number":36,"context_line":"command is about to be run. In daemon mode a separate method is called instead"},{"line_number":37,"context_line":"that starts RPC [#rpc]_ server and falls into infinite loop serving requests."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Daemon API"},{"line_number":40,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_131177ac","line":37,"updated":"2014-05-21 22:13:41.000000000","message":"\"RPC\" means something very specific to an OpenStack service (oslo.messaging, message bus, etc.). I don\u0027t think that\u0027s what you mean here, is it?","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"f90392a1aa5515bee6a3c6deecb1d36f974f9d3d","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The startup process is the same as in normal mode up to the point when the"},{"line_number":36,"context_line":"command is about to be run. In daemon mode a separate method is called instead"},{"line_number":37,"context_line":"that starts RPC [#rpc]_ server and falls into infinite loop serving requests."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Daemon API"},{"line_number":40,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_e516f6f0","line":37,"in_reply_to":"7adec928_131177ac","updated":"2014-05-22 07:31:02.000000000","message":"Not at all. I\u0027ve added a footnote specifically to avoid such confusion. Do you think I should do smth more eye-catching?","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Here is a sketch of basic usage for rootwrap daemon::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  \u003e\u003e\u003e from subprocess import *"},{"line_number":69,"context_line":"  \u003e\u003e\u003e from multiprocessing.managers import BaseManager                                                                                                                                                                                                                                                                           "},{"line_number":70,"context_line":"  \u003e\u003e\u003e process \u003d Popen([\"rootwrap-daemon\", \"rootwrap.conf\"], stdout\u003dPIPE)"},{"line_number":71,"context_line":"  \u003e\u003e\u003e address \u003d process.stdout.readline()[:-1]"},{"line_number":72,"context_line":"  \u003e\u003e\u003e authkey \u003d process.stdout.read(32)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_d32f0ff5","line":69,"updated":"2014-05-21 22:13:41.000000000","message":"There are trailing whitespace issues in a few places.","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"68354a7800515c45bcf8e1777500be48ae394377","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Here is a sketch of basic usage for rootwrap daemon::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  \u003e\u003e\u003e from subprocess import *"},{"line_number":69,"context_line":"  \u003e\u003e\u003e from multiprocessing.managers import BaseManager                                                                                                                                                                                                                                                                           "},{"line_number":70,"context_line":"  \u003e\u003e\u003e process \u003d Popen([\"rootwrap-daemon\", \"rootwrap.conf\"], stdout\u003dPIPE)"},{"line_number":71,"context_line":"  \u003e\u003e\u003e address \u003d process.stdout.readline()[:-1]"},{"line_number":72,"context_line":"  \u003e\u003e\u003e authkey \u003d process.stdout.read(32)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_d7c0d12c","line":69,"in_reply_to":"7adec928_85c9b25c","updated":"2014-05-22 13:15:54.000000000","message":"Done","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"f90392a1aa5515bee6a3c6deecb1d36f974f9d3d","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Here is a sketch of basic usage for rootwrap daemon::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  \u003e\u003e\u003e from subprocess import *"},{"line_number":69,"context_line":"  \u003e\u003e\u003e from multiprocessing.managers import BaseManager                                                                                                                                                                                                                                                                           "},{"line_number":70,"context_line":"  \u003e\u003e\u003e process \u003d Popen([\"rootwrap-daemon\", \"rootwrap.conf\"], stdout\u003dPIPE)"},{"line_number":71,"context_line":"  \u003e\u003e\u003e address \u003d process.stdout.readline()[:-1]"},{"line_number":72,"context_line":"  \u003e\u003e\u003e authkey \u003d process.stdout.read(32)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_85c9b25c","line":69,"in_reply_to":"7adec928_d32f0ff5","updated":"2014-05-22 07:31:02.000000000","message":"Oh, it looks like Vim like Python code more that ReST. Will fix that.","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  \u003e\u003e\u003e from subprocess import *"},{"line_number":69,"context_line":"  \u003e\u003e\u003e from multiprocessing.managers import BaseManager                                                                                                                                                                                                                                                                           "},{"line_number":70,"context_line":"  \u003e\u003e\u003e process \u003d Popen([\"rootwrap-daemon\", \"rootwrap.conf\"], stdout\u003dPIPE)"},{"line_number":71,"context_line":"  \u003e\u003e\u003e address \u003d process.stdout.readline()[:-1]"},{"line_number":72,"context_line":"  \u003e\u003e\u003e authkey \u003d process.stdout.read(32)"},{"line_number":73,"context_line":"  \u003e\u003e\u003e class MyManager(BaseManager): pass"},{"line_number":74,"context_line":"  ... "}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_f3824bc7","line":71,"updated":"2014-05-21 22:13:41.000000000","message":"Rather than interacting with stdout from the subprocess, it might be more reliable to have the parent process generate these values and send them to the daemon as environment variables. Wrapping the logic for creating the subprocess and manager in a function would still let us isolate that code in a single place inside the rootwrap library. Unless this is somehow less secure than the proposed design?","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"f90392a1aa5515bee6a3c6deecb1d36f974f9d3d","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  \u003e\u003e\u003e from subprocess import *"},{"line_number":69,"context_line":"  \u003e\u003e\u003e from multiprocessing.managers import BaseManager                                                                                                                                                                                                                                                                           "},{"line_number":70,"context_line":"  \u003e\u003e\u003e process \u003d Popen([\"rootwrap-daemon\", \"rootwrap.conf\"], stdout\u003dPIPE)"},{"line_number":71,"context_line":"  \u003e\u003e\u003e address \u003d process.stdout.readline()[:-1]"},{"line_number":72,"context_line":"  \u003e\u003e\u003e authkey \u003d process.stdout.read(32)"},{"line_number":73,"context_line":"  \u003e\u003e\u003e class MyManager(BaseManager): pass"},{"line_number":74,"context_line":"  ... "}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_45feca6c","line":71,"in_reply_to":"7adec928_f3824bc7","updated":"2014-05-22 07:31:02.000000000","message":"I don\u0027t think these approaches differ in the security level. I just don\u0027t like unprivileged process telling the privileged one where to open socket. I\u0027d prefer it to remain as is since there\u0027s not much difference from the developer perspective as well.","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Its constructor expects one argument - a list that can be passed to ``Popen``"},{"line_number":97,"context_line":"to create rootwrap daemon process. For Neutron it\u0027ll be"},{"line_number":98,"context_line":"``[\"sudo\", \"neutron-rootwrap-daemon\"]`` for example."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The class provides one method ``execute`` with the same profile as"},{"line_number":101,"context_line":"``run_one_command`` method shown above."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_d3cb8f1c","line":98,"updated":"2014-05-21 22:13:41.000000000","message":"This expects the caller to know a lot about how the environment is configured. Does the list of arguments come from a configuration setting?\n\nIsn\u0027t sudo always required?\n\nAre there ever more than 2 arguments (the config file is included in the popen args above, but not here)?","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"68354a7800515c45bcf8e1777500be48ae394377","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Its constructor expects one argument - a list that can be passed to ``Popen``"},{"line_number":97,"context_line":"to create rootwrap daemon process. For Neutron it\u0027ll be"},{"line_number":98,"context_line":"``[\"sudo\", \"neutron-rootwrap-daemon\"]`` for example."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The class provides one method ``execute`` with the same profile as"},{"line_number":101,"context_line":"``run_one_command`` method shown above."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_b7c34537","line":98,"in_reply_to":"7adec928_17795993","updated":"2014-05-22 13:15:54.000000000","message":"Done","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"f90392a1aa5515bee6a3c6deecb1d36f974f9d3d","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Its constructor expects one argument - a list that can be passed to ``Popen``"},{"line_number":97,"context_line":"to create rootwrap daemon process. For Neutron it\u0027ll be"},{"line_number":98,"context_line":"``[\"sudo\", \"neutron-rootwrap-daemon\"]`` for example."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The class provides one method ``execute`` with the same profile as"},{"line_number":101,"context_line":"``run_one_command`` method shown above."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_17795993","line":98,"in_reply_to":"7adec928_d3cb8f1c","updated":"2014-05-22 07:31:02.000000000","message":"\u003e This expects the caller to know a lot about how the environment is configured.\n\nI wouldn\u0027t say so. It requires deployer to provide the service with its binaries accessible via sudo. It\u0027s how it currently works, my change would only require add another line to sudoers file.\n\n\u003e Does the list of arguments come from a configuration setting?\n\nIt\u0027s up to calling process. Nova and Cinder already hardcode smth like \"sudo nova-rootwrap\" + config, Neutron will shift in that direction with my changes.\n\n\u003e Isn\u0027t sudo always required?\n\nIt\u0027s not a hard requirement. I can imagine more sophisticated use of rootwrap (almost) without sudo. For example, you can run the daemon in some network namespace and use it to avoid cost of namespace environment setup.\n\n\u003e Are there ever more than 2 arguments (the config file is included in the popen args above, but not here)?\n\nYeah, missed the config file. Will fix.","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":131,"context_line":"   Managers use threadlocal connections so there\u0027s no need to create a pool of"},{"line_number":132,"context_line":"   them. Although it might sound wasteful to create new connection for every"},{"line_number":133,"context_line":"   thread, creating a connection over UNIX socket is almost nothing compared to"},{"line_number":134,"context_line":"   spawning a new process time-wise."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"#. On-wire protocol"},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_9354a722","line":134,"updated":"2014-05-21 22:13:41.000000000","message":"How well does multiprocessing\u0027s communication code work eventlet-patched libraries? Do we need to do anything to explicitly address eventlet?","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"f90392a1aa5515bee6a3c6deecb1d36f974f9d3d","unresolved":false,"context_lines":[{"line_number":131,"context_line":"   Managers use threadlocal connections so there\u0027s no need to create a pool of"},{"line_number":132,"context_line":"   them. Although it might sound wasteful to create new connection for every"},{"line_number":133,"context_line":"   thread, creating a connection over UNIX socket is almost nothing compared to"},{"line_number":134,"context_line":"   spawning a new process time-wise."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"#. On-wire protocol"},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_77dc5d75","line":134,"in_reply_to":"7adec928_9354a722","updated":"2014-05-22 07:31:02.000000000","message":"eventlet monkey-patches core \"tread\" module. After that multiprocessing works fine using eventlet\u0027s primitives without knowing it.\n\nYou can see this working in Neutron\u0027s agents, for example.","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Scrap rootwrap, switch to sudo."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"  We\u0027ll loose current fine-grained control over what can be run as root."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"* Use other interpretator for rootwrap."},{"line_number":163,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_13409755","line":160,"updated":"2014-05-21 22:13:41.000000000","message":"s/loose/lose/","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"68354a7800515c45bcf8e1777500be48ae394377","unresolved":false,"context_lines":[{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Scrap rootwrap, switch to sudo."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"  We\u0027ll loose current fine-grained control over what can be run as root."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"* Use other interpretator for rootwrap."},{"line_number":163,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_f72a2de6","line":160,"in_reply_to":"7adec928_13409755","updated":"2014-05-22 13:15:54.000000000","message":"Done","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"15c603d6362c8037f331b83e419abdbb673291db","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"* Filter commands on the calling process side and use sudo."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"  This would provide the same security as the first option."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Implementation"},{"line_number":180,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_d31c6f7a","line":177,"updated":"2014-05-21 22:13:41.000000000","message":"Another alternative was updating the applications, like neutron, that call rootwrap with many individual commands so that they could \"batch\" them by creating shell scripts that could be run as one command. This was rejected on the grounds that it is too difficult to find the right series of commands (at least for neutron).","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"68354a7800515c45bcf8e1777500be48ae394377","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"* Filter commands on the calling process side and use sudo."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"  This would provide the same security as the first option."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Implementation"},{"line_number":180,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7adec928_17307955","line":177,"in_reply_to":"7adec928_d31c6f7a","updated":"2014-05-22 13:15:54.000000000","message":"Done","commit_id":"991c361bb0acd1b13b3dafa4a02017132b1c3688"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d40e024140492aa04bc6d7f704b2963a3447ce53","unresolved":false,"context_lines":[{"line_number":111,"context_line":"Under the hood"},{"line_number":112,"context_line":"--------------"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The biggest expected security hole in this proposal is the way that client"},{"line_number":115,"context_line":"talks to daemon so I\u0027ll discuss the underlying protocol in details."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"#. Credentials passing"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7adec928_9af489d0","line":114,"updated":"2014-05-23 09:40:47.000000000","message":"Maybe \"security risk\" -- it\u0027s not a hole (yet) :)","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"fb9d27f53e6cf47561f9dc24af18a8f0fa459a20","unresolved":false,"context_lines":[{"line_number":111,"context_line":"Under the hood"},{"line_number":112,"context_line":"--------------"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The biggest expected security hole in this proposal is the way that client"},{"line_number":115,"context_line":"talks to daemon so I\u0027ll discuss the underlying protocol in details."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"#. Credentials passing"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5adbc538_316cca9c","line":114,"in_reply_to":"7adec928_9af489d0","updated":"2014-05-26 09:38:19.000000000","message":"Done","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d40e024140492aa04bc6d7f704b2963a3447ce53","unresolved":false,"context_lines":[{"line_number":140,"context_line":"   requests and responses but it\u0027s very unsafe as it allows to call any method"},{"line_number":141,"context_line":"   on the receiving side (see warning in [#pickle]_). The only other option is"},{"line_number":142,"context_line":"   to use ``xmlrpclib`` as a serializer. It won\u0027t go away (see [#ser_bug]_) so"},{"line_number":143,"context_line":"   it\u0027s safe to use."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"#. Per-host daemon process"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7adec928_fa182d86","line":143,"updated":"2014-05-23 09:40:47.000000000","message":"xmlrpc support is not documented though.\n\nFrom this bug read, xmlrpc support is not going away as a feature, however the author says he is not satisfied with the API... So that may change without warning in the future, and the API may end up differring between versions of python... I fear that unless the author confirms that (1) it\u0027s not going away and (2) the current API will always be supported, it\u0027s a bit risky to use ?","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"fb9d27f53e6cf47561f9dc24af18a8f0fa459a20","unresolved":false,"context_lines":[{"line_number":140,"context_line":"   requests and responses but it\u0027s very unsafe as it allows to call any method"},{"line_number":141,"context_line":"   on the receiving side (see warning in [#pickle]_). The only other option is"},{"line_number":142,"context_line":"   to use ``xmlrpclib`` as a serializer. It won\u0027t go away (see [#ser_bug]_) so"},{"line_number":143,"context_line":"   it\u0027s safe to use."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"#. Per-host daemon process"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5adbc538_71a1f2a8","line":143,"in_reply_to":"7adec928_fa182d86","updated":"2014-05-26 09:38:19.000000000","message":"The API might actually change (I\u0027d vote for changing it, actually) but I guess we can rely on Python\u0027s stability or declare supported Python version as \"up to 3.4\".\n\nAs for xmlrpclib support I guess we won\u0027t depend on it since I\u0027m going to implement JSON support anyway.","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d40e024140492aa04bc6d7f704b2963a3447ce53","unresolved":false,"context_lines":[{"line_number":146,"context_line":""},{"line_number":147,"context_line":"   This would require some D-Bus or MQ set up and security. It doesn\u0027t look"},{"line_number":148,"context_line":"   feasible to set up such secure daemons and supporting them across projects"},{"line_number":149,"context_line":"   seams even less so."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Alternatives"},{"line_number":152,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7adec928_faa10daa","line":149,"updated":"2014-05-23 09:40:47.000000000","message":"Also different services on the host run rootwrap with different configuration files (for example neutron-rootwrap lets neutron agents run some commands, while nova-compute uses nova-rootwrap with a different config file to allow nova user to run different commands).\n\nSo I\u0027m not sure that paragraph brings any value to the spec, to be honest.","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"fb9d27f53e6cf47561f9dc24af18a8f0fa459a20","unresolved":false,"context_lines":[{"line_number":146,"context_line":""},{"line_number":147,"context_line":"   This would require some D-Bus or MQ set up and security. It doesn\u0027t look"},{"line_number":148,"context_line":"   feasible to set up such secure daemons and supporting them across projects"},{"line_number":149,"context_line":"   seams even less so."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Alternatives"},{"line_number":152,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5adbc538_51aa3671","line":149,"in_reply_to":"7adec928_faa10daa","updated":"2014-05-26 09:38:19.000000000","message":"Oh, I\u0027ve just placed it in the wrong section. It\u0027s related to Alternatives.\n\nDone","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d40e024140492aa04bc6d7f704b2963a3447ce53","unresolved":false,"context_lines":[{"line_number":199,"context_line":"Daemon itself will listen UNIX domain socket but every connection is passed"},{"line_number":200,"context_line":"through digest authentication."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"XML will be used as a transport. **XML is unsafe, will investigate further!**"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"Performance Impact"},{"line_number":205,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7adec928_7af89d7c","line":202,"updated":"2014-05-23 09:40:47.000000000","message":"Indeed, you need to make sure you disable all the advanced features that can be exploited, like DTD-based attacks. Full picture of possible attacks at http://msdn.microsoft.com/en-us/magazine/ee335713.aspx -- you basically need to use a defused XML parsing library.","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"fb9d27f53e6cf47561f9dc24af18a8f0fa459a20","unresolved":false,"context_lines":[{"line_number":199,"context_line":"Daemon itself will listen UNIX domain socket but every connection is passed"},{"line_number":200,"context_line":"through digest authentication."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"XML will be used as a transport. **XML is unsafe, will investigate further!**"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"Performance Impact"},{"line_number":205,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5adbc538_d4ed548d","line":202,"in_reply_to":"7adec928_7af89d7c","updated":"2014-05-26 09:38:19.000000000","message":"Since we\u0027d have to create a new serializer for defused library anyway it think it\u0027s safer to use JSON instead.","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d40e024140492aa04bc6d7f704b2963a3447ce53","unresolved":false,"context_lines":[{"line_number":212,"context_line":"--------------------"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"None in oslo.rootwrap itself. Projects using it might require a separate option"},{"line_number":215,"context_line":"for new behavior."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Developer Impact"},{"line_number":218,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7adec928_5ad5a1b7","line":215,"updated":"2014-05-23 09:40:47.000000000","message":"So... this will require a bunch of changes on the consumer side (neutron, nova...), to care for the difference in calling rootwrap in direct mode and in daemon mode. Rather than having to copy this code around between neutron, nova etc. we talked about shipping that code in oslo.processutils and then make sure the consumers use processutils execute function (rather than their own copy in nova.utils.execute or elsewhere).\n\nShould that live in this spec ? I.e. should this spec impact oslo.rootwrap AND oslo.processutils ? Or should we have a separate spec for processutils ?","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"fb9d27f53e6cf47561f9dc24af18a8f0fa459a20","unresolved":false,"context_lines":[{"line_number":212,"context_line":"--------------------"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"None in oslo.rootwrap itself. Projects using it might require a separate option"},{"line_number":215,"context_line":"for new behavior."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Developer Impact"},{"line_number":218,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5adbc538_ff6ea995","line":215,"in_reply_to":"7adec928_5ad5a1b7","updated":"2014-05-26 09:38:19.000000000","message":"Consumer projects will require just one \"if\" and a call to rootwrap\u0027s Client. It might be good to abstract these things out to processutils. The work I did in Neutron can be moved there then: https://review.openstack.org/#/c/84667/21/neutron/agent/linux/utils.py,cm\n\nI\u0027m not sure if this would require a separate blueprint or should it be added here.","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d40e024140492aa04bc6d7f704b2963a3447ce53","unresolved":false,"context_lines":[{"line_number":235,"context_line":"----------"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Target Milestone for completion:"},{"line_number":238,"context_line":"  Juno-1"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"Work Items"},{"line_number":241,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7adec928_3d21af9f","line":238,"updated":"2014-05-23 09:40:47.000000000","message":"At this point we need two things: security reviews (XML parsing comes to mind) and more assurance around xmlrpclib support in multiprocessing. Since those are a bit external, may result in this being pushed back to juno-2...","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"fb9d27f53e6cf47561f9dc24af18a8f0fa459a20","unresolved":false,"context_lines":[{"line_number":235,"context_line":"----------"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Target Milestone for completion:"},{"line_number":238,"context_line":"  Juno-1"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"Work Items"},{"line_number":241,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5adbc538_1ff195cd","line":238,"in_reply_to":"7adec928_3d21af9f","updated":"2014-05-26 09:38:19.000000000","message":"I think we can keep Juno-1 here and change it to Juno-2 if there won\u0027t be enough done to push it in time.","commit_id":"d9df9bb2dab0efc629b49c6455f1efebeda7c792"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"6529edfb9180dde916c9ff33ee956eaf184716ed","unresolved":false,"context_lines":[{"line_number":143,"context_line":"   to use ``xmlrpclib`` as a serializer but it\u0027s unsafe as it\u0027s prone to"},{"line_number":144,"context_line":"   resource exhaustion attacks [#xml_unsafe]_. That\u0027s why JSON serialization"},{"line_number":145,"context_line":"   support is implemented. It\u0027s very simple (~50 SLOC) and is safe because JSON"},{"line_number":146,"context_line":"   serialization is safe."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Alternatives"},{"line_number":149,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_55078cc9","line":146,"updated":"2014-06-23 08:55:41.000000000","message":"I think you need to mention somewhere in this spec that we are making use of an undocumented parameter from multiprocessing API (the serializer parameter), for which we got \"reasonable confidence\" from the author that it won\u0027t go away (with reference to [#ser_bug_]).\n\nSince it\u0027s undocumented, it\u0027s also a bit unclear how you plug new serialization mechanisms into multiprocessing. Is the parameter value the name of the class to use ?","commit_id":"755083803a868cbf634e0ea120fee4764facb49d"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"fffd25128cf74c0665252cc43ef72db665e2df5c","unresolved":false,"context_lines":[{"line_number":143,"context_line":"   to use ``xmlrpclib`` as a serializer but it\u0027s unsafe as it\u0027s prone to"},{"line_number":144,"context_line":"   resource exhaustion attacks [#xml_unsafe]_. That\u0027s why JSON serialization"},{"line_number":145,"context_line":"   support is implemented. It\u0027s very simple (~50 SLOC) and is safe because JSON"},{"line_number":146,"context_line":"   serialization is safe."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Alternatives"},{"line_number":149,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_909be265","line":146,"in_reply_to":"1ae5cdf2_55078cc9","updated":"2014-06-23 09:23:07.000000000","message":"Done","commit_id":"755083803a868cbf634e0ea120fee4764facb49d"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"ae40e3d4c5bb95e497b17b71622d77fff71b9b9c","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Daemon will be started using a separate binary (like neutron-rootwrap-daemon"},{"line_number":31,"context_line":"for Neutron) pointing to ``oslo.rootwrap.cmd:daemon`` endpoint (instead of"},{"line_number":32,"context_line":"``:main``). The binary will receive the same options as the normal one except"},{"line_number":33,"context_line":"the command to be run in priviledged mode."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The startup process is the same as in normal mode up to the point when the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_9104b97f","line":32,"updated":"2014-07-01 04:43:48.000000000","message":"Let me see if I understand.  Are you saying that the daemon is called the same way as legacy root wrap minus the command to run?  Does it need an extra option like --daemon or -d to run daemon mode?\n\nA really simple example might help here.","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Daemon will be started using a separate binary (like neutron-rootwrap-daemon"},{"line_number":31,"context_line":"for Neutron) pointing to ``oslo.rootwrap.cmd:daemon`` endpoint (instead of"},{"line_number":32,"context_line":"``:main``). The binary will receive the same options as the normal one except"},{"line_number":33,"context_line":"the command to be run in priviledged mode."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The startup process is the same as in normal mode up to the point when the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_2d5190d8","line":32,"in_reply_to":"baada198_9104b97f","updated":"2014-07-02 15:18:57.000000000","message":"Yes, you get it right. No, no extra options needed.\n\nDone","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"ae40e3d4c5bb95e497b17b71622d77fff71b9b9c","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"These credentials can be used to connect a"},{"line_number":49,"context_line":"``multiprocessing.BaseManager``-based client. Because ``pickle`` and"},{"line_number":50,"context_line":"``xmlrpclib`` are unsafe, it uses its own JSON serialization. The only exposed"},{"line_number":51,"context_line":"object is ``rootwrap`` with one method:"},{"line_number":52,"context_line":"``run_one_command(userargs, env\u003dNone, stdin\u003dNone)``. Arguments are:"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_912bd9ea","line":50,"updated":"2014-07-01 04:43:48.000000000","message":"For the curious.  What makes them unsafe?  How will the JSON implementation be guaranteed safe?\n\nUpdate:  You answer this below.  A link to that section might be good here.","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"These credentials can be used to connect a"},{"line_number":49,"context_line":"``multiprocessing.BaseManager``-based client. Because ``pickle`` and"},{"line_number":50,"context_line":"``xmlrpclib`` are unsafe, it uses its own JSON serialization. The only exposed"},{"line_number":51,"context_line":"object is ``rootwrap`` with one method:"},{"line_number":52,"context_line":"``run_one_command(userargs, env\u003dNone, stdin\u003dNone)``. Arguments are:"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0de68cb4","line":50,"in_reply_to":"baada198_912bd9ea","updated":"2014-07-02 15:18:57.000000000","message":"Done","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"ae40e3d4c5bb95e497b17b71622d77fff71b9b9c","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"The class lazily creates an instance of the daemon, connects to it and passes"},{"line_number":106,"context_line":"arguments. Note that some reconnection and respawning mechanism will be in"},{"line_number":107,"context_line":"place so that if daemon process dies, ``Client`` will simply restart it."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"This laziness will allow user to kill all rootwrap daemon processes to reload"},{"line_number":110,"context_line":"config file, for example."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_714645c1","line":107,"updated":"2014-07-01 04:43:48.000000000","message":"Restart right away or also lazily?","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"The class lazily creates an instance of the daemon, connects to it and passes"},{"line_number":106,"context_line":"arguments. Note that some reconnection and respawning mechanism will be in"},{"line_number":107,"context_line":"place so that if daemon process dies, ``Client`` will simply restart it."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"This laziness will allow user to kill all rootwrap daemon processes to reload"},{"line_number":110,"context_line":"config file, for example."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6d99c81e","line":107,"in_reply_to":"baada198_714645c1","updated":"2014-07-02 15:18:57.000000000","message":"Lazily (-ish?)\n\nDone","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"ae40e3d4c5bb95e497b17b71622d77fff71b9b9c","unresolved":false,"context_lines":[{"line_number":133,"context_line":"   Managers use threadlocal connections so there\u0027s no need to create a pool of"},{"line_number":134,"context_line":"   them. Although it might sound wasteful to create new connection for every"},{"line_number":135,"context_line":"   thread, creating a connection over UNIX socket is almost nothing compared to"},{"line_number":136,"context_line":"   spawning a new process time-wise."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"#. On-wire protocol"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_9112f9b2","line":136,"updated":"2014-07-01 04:43:48.000000000","message":"Good point.","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"ae40e3d4c5bb95e497b17b71622d77fff71b9b9c","unresolved":false,"context_lines":[{"line_number":143,"context_line":"   to use ``xmlrpclib`` as a serializer but it\u0027s unsafe as it\u0027s prone to"},{"line_number":144,"context_line":"   resource exhaustion attacks [#xml_unsafe]_. That\u0027s why JSON serialization"},{"line_number":145,"context_line":"   support is implemented. It\u0027s very simple (~50 SLOC) and is safe because JSON"},{"line_number":146,"context_line":"   serialization is safe."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"   This serialization is plugged in using undocumented features of"},{"line_number":149,"context_line":"   ``multiprocessing.managers`` module:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_116d0933","line":146,"updated":"2014-07-01 04:43:48.000000000","message":"This sounds like saying it is safe because it is safe.  I\u0027d be happy with \"and JSON serialization is widely regarded as being safe.\"","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":143,"context_line":"   to use ``xmlrpclib`` as a serializer but it\u0027s unsafe as it\u0027s prone to"},{"line_number":144,"context_line":"   resource exhaustion attacks [#xml_unsafe]_. That\u0027s why JSON serialization"},{"line_number":145,"context_line":"   support is implemented. It\u0027s very simple (~50 SLOC) and is safe because JSON"},{"line_number":146,"context_line":"   serialization is safe."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"   This serialization is plugged in using undocumented features of"},{"line_number":149,"context_line":"   ``multiprocessing.managers`` module:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_adba006c","line":146,"in_reply_to":"baada198_116d0933","updated":"2014-07-02 15:18:57.000000000","message":"Done","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"daa0dbce43bd2590c3268f5d6fd7f3154d502c8b","unresolved":false,"context_lines":[{"line_number":154,"context_line":"     contains a key in ``listener_client`` dictionary."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"   The author of ``multiprocessing`` module assured that this mechanism is not"},{"line_number":157,"context_line":"   going to go away any time soon [#ser_bug]_."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Alternatives"},{"line_number":160,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_dc4b6829","line":157,"updated":"2014-07-02 13:49:34.000000000","message":"I think this should be explicitly called out as a slight risk (rely on undocumented feature), mitigated by the fact that the author of the module assured that the mechanism is not going away.","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":154,"context_line":"     contains a key in ``listener_client`` dictionary."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"   The author of ``multiprocessing`` module assured that this mechanism is not"},{"line_number":157,"context_line":"   going to go away any time soon [#ser_bug]_."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Alternatives"},{"line_number":160,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_682a967f","line":157,"in_reply_to":"baada198_dc4b6829","updated":"2014-07-02 15:18:57.000000000","message":"Done","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"daa0dbce43bd2590c3268f5d6fd7f3154d502c8b","unresolved":false,"context_lines":[{"line_number":177,"context_line":"  This includes suggestions to rewrite entirely or partially in C or some"},{"line_number":178,"context_line":"  Python dialect that would be translateable to C."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"  As OpenStack commutity is focused on Python development, bringing some other"},{"line_number":181,"context_line":"  language to the field would require more developers that would be familiar"},{"line_number":182,"context_line":"  with it."},{"line_number":183,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_3ce38434","line":180,"updated":"2014-07-02 13:49:34.000000000","message":"typo: community\n\nDo not fix this unless you do another patchset for some other reason anyway.","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":177,"context_line":"  This includes suggestions to rewrite entirely or partially in C or some"},{"line_number":178,"context_line":"  Python dialect that would be translateable to C."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"  As OpenStack commutity is focused on Python development, bringing some other"},{"line_number":181,"context_line":"  language to the field would require more developers that would be familiar"},{"line_number":182,"context_line":"  with it."},{"line_number":183,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6851b60d","line":180,"in_reply_to":"baada198_3ce38434","updated":"2014-07-02 15:18:57.000000000","message":"Done","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"daa0dbce43bd2590c3268f5d6fd7f3154d502c8b","unresolved":false,"context_lines":[{"line_number":188,"context_line":"* Consolidate calls that use rootwrap into scripts"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"  We could create scripts that would require only one rootwrap call to do all"},{"line_number":191,"context_line":"  necessary work for one requrest, for example. But these scripts will either"},{"line_number":192,"context_line":"  become very complex (say rewriting parts of Neutron agents in shell) or there"},{"line_number":193,"context_line":"  will be too many of them. Either way defeats the purpose of sudo and rootwrap"},{"line_number":194,"context_line":"  - to minimize amount and complexity of code running with root priviledges."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_1c0400bf","line":191,"updated":"2014-07-02 13:49:34.000000000","message":"Typo: request\n\nDo not fix this unless you do another patchset for some other reason anyway.","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":188,"context_line":"* Consolidate calls that use rootwrap into scripts"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"  We could create scripts that would require only one rootwrap call to do all"},{"line_number":191,"context_line":"  necessary work for one requrest, for example. But these scripts will either"},{"line_number":192,"context_line":"  become very complex (say rewriting parts of Neutron agents in shell) or there"},{"line_number":193,"context_line":"  will be too many of them. Either way defeats the purpose of sudo and rootwrap"},{"line_number":194,"context_line":"  - to minimize amount and complexity of code running with root priviledges."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_a85bce2c","line":191,"in_reply_to":"baada198_1c0400bf","updated":"2014-07-02 15:18:57.000000000","message":"Done","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"daa0dbce43bd2590c3268f5d6fd7f3154d502c8b","unresolved":false,"context_lines":[{"line_number":214,"context_line":"Daemon itself will listen UNIX domain socket but every connection is passed"},{"line_number":215,"context_line":"through digest authentication."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"JSON is used as a transport so it is safe."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Performance Impact"},{"line_number":220,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_1cf240d2","line":217,"updated":"2014-07-02 13:49:34.000000000","message":"Maybe \"JSON is used as a transport to avoid known vulnerabilities in other types of serialization mechanisms\" ?","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":214,"context_line":"Daemon itself will listen UNIX domain socket but every connection is passed"},{"line_number":215,"context_line":"through digest authentication."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"JSON is used as a transport so it is safe."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Performance Impact"},{"line_number":220,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_a872eeaa","line":217,"in_reply_to":"baada198_1cf240d2","updated":"2014-07-02 15:18:57.000000000","message":"Done","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"daa0dbce43bd2590c3268f5d6fd7f3154d502c8b","unresolved":false,"context_lines":[{"line_number":227,"context_line":"--------------------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"None in oslo.rootwrap itself. Projects using it might require a separate option"},{"line_number":230,"context_line":"for new behavior."},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Developer Impact"},{"line_number":233,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_3c72a449","line":230,"updated":"2014-07-02 13:49:34.000000000","message":"Maybe add that the standalone mode is not affected, so anything that was working before should continue to work as usual ?","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":708,"name":"Yuriy Taraday","email":"yuriy@taraday.nl","username":"yorik-sar"},"change_message_id":"7318c9a66ff4857fe24bffb8e1a52eaf97c92174","unresolved":false,"context_lines":[{"line_number":227,"context_line":"--------------------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"None in oslo.rootwrap itself. Projects using it might require a separate option"},{"line_number":230,"context_line":"for new behavior."},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Developer Impact"},{"line_number":233,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_88a60a0f","line":230,"in_reply_to":"baada198_3c72a449","updated":"2014-07-02 15:18:57.000000000","message":"I\u0027ll add this to \"Impact on Existing APIs\" section.\n\nDone","commit_id":"087fe8c4c7177e4b4d223096abc8ca6ae256921b"},{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"f4388af8462e29b8a7fad7ba4b911029021cd911","unresolved":false,"context_lines":[{"line_number":146,"context_line":"   to use ``xmlrpclib`` as a serializer but it\u0027s unsafe as it\u0027s prone to"},{"line_number":147,"context_line":"   resource exhaustion attacks [#xml_unsafe]_. That\u0027s why JSON serialization"},{"line_number":148,"context_line":"   support is implemented. It\u0027s very simple (~50 SLOC) and is safe because JSON"},{"line_number":149,"context_line":"   serialization is widely regarded as being safe."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"   This serialization is plugged in using undocumented features of"},{"line_number":152,"context_line":"   ``multiprocessing.managers`` module:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_bd0e1c8a","line":149,"updated":"2014-07-07 22:12:52.000000000","message":"I\u0027m pretty sure this reasoning wouldn\u0027t fly with a security person, but at the same time I\u0027m not aware of anything that would contradict it. :-)","commit_id":"cf1d483749606e09d616824ea501c4dbd3b852ad"}]}