Packager/Rootwrap - Revision history

Ryan Lane: Text replace - "NOTOC" to ""

2013-02-17T23:31:13Z

Text replace - "__NOTOC__" to ""

ThierryCarrez at 10:04, 27 September 2012

2012-09-27T10:04:46Z

ThierryCarrez at 14:29, 25 June 2012

2012-06-25T14:29:40Z

ThierryCarrez at 14:00, 7 March 2012

2012-03-07T14:00:00Z

ThierryCarrez at 10:25, 9 December 2011

2011-12-09T10:25:15Z

New page

__NOTOC__
= Packaging tips: the Nova root helper =

Nova runs under an unprivileged user (typically called ''nova'') and comes with a mechanism to run some commands as ''root''. This mechanism needs packaging support to work properly.

== Option 1: --root_helper=sudo (default) ==

For this to work, you have to provide ''sudoers'' directives matching the commands that Nova needs:

<pre><nowiki>
Cmnd_Alias NOVACMDS = /sbin/ifconfig, \
/sbin/ip, \
...
/usr/sbin/dnsmasq \
/sbin/kpartx

nova ALL = (root) NOPASSWD: SETENV: NOVACMDS
</nowiki></pre>

These directives (or a ''sudoers.d/'' file containing them) should be installed on all Nova nodes, though you also have the option to split the commands allowed based on the type of node requiring them.

Note that this option forces you to maintain the commands in the ''sudoers'' file in packaging, which is a bit daunting and brittle. To avoid that, continue reading.

== Option 2: --root_helper=sudo nova-rootwrap ==

Starting with Essex-2, a more secure option is available, allowing more precise control over the commands and arguments used. It is also more maintainable, since the commands are maintained in Nova code instead of in the packaging.

It's a bit more tricky to set up. First you need to ship ''/usr/bin/nova-rootwrap'' and a ''nova.conf'' file with the following option:

<pre><nowiki>
--root_helper=sudo nova-rootwrap
</nowiki></pre>

The ''sudoers'' directives are static and simplified to:

<pre><nowiki>
nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap
</nowiki></pre>

Finally, with this option, commands are defined in filter files (in Python) which need to be shipped only with the type of node they affect. So:

* ''nova/rootwrap/compute.py'' should only be included in the ''nova-compute'' node package
* ''nova/rootwrap/network.py'' should only be included in the ''nova-network'' node package
* ''nova/rootwrap/volume.py'' should only be included in the ''nova-volume'' node package

This allows to limit ''root'' commands only to nodes needing them, rather than to the ''nova'' user.

← Older revision		Revision as of 23:31, 17 February 2013
Line 1:		Line 1:
−	~~__NOTOC__~~	+
	= Packaging tips: the Nova root helper =		= Packaging tips: the Nova root helper =

← Older revision		Revision as of 10:04, 27 September 2012
Line 12:		Line 12:
	=== nova.conf ===		=== nova.conf ===

−	root_helper needs to include the configuration file ~~now~~:	+	The root_helper parameter is deprecated in favor of the rootwrap_config parameter:
		+
		+
		+	<pre><nowiki>
		+	rootwrap_config=/etc/nova/rootwrap.conf
		+	</nowiki></pre>
		+
		+
		+	If you still want to use root_helper, it now needs to include the configuration file:

← Older revision		Revision as of 14:00, 7 March 2012
Line 43:		Line 43:
	</nowiki></pre>		</nowiki></pre>

		+
		+	You should make sure setenv is not set, to disallow the nova user to preserve the environment.

	Finally, with this option, commands are defined in filter files (in Python) which need to be shipped only with the type of node they affect. So:		Finally, with this option, commands are defined in filter files (in Python) which need to be shipped only with the type of node they affect. So: