Remove scstadmin from rootwrap

Use oslo.privsep for scstadmin and remove it from
etc/cinder/rootwrap.d/volume.filters.

Change-Id: I55c8d40ee082a32fa51c893845a0b0aa4dad1492
Signed-off-by: Chuck Short <chucks@redhat.com>

cinder/privsep/targets/scst.py

@@ -0,0 +1,28 @@
+# Copyright 2018 Red Hat, Inc
+# Copyright 2017 Rackspace Australia
+# Copyright 2018 Michael Still and Aptira
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Helpers for scst related routines.
+"""
+
+from oslo_concurrency import processutils
+
+import cinder.privsep
+
+
+@cinder.privsep.sys_admin_pctxt.entrypoint
+def run_scstadmin(*args):
+    return processutils.execute('scstadmin', *args)

cinder/tests/unit/targets/test_scst_driver.py

@@ -83,9 +83,9 @@ class TestSCSTAdmDriver(tf.TargetDriverFixture):
             'iqn.2010-10.org.openstack:'
             'volume-ed2c2222-5fc0-11e4-aa15-123b93f75cba'))
 
-    @mock.patch.object(utils, 'execute')
-    def test_target_attribute(self, mock_execute):
-        mock_execute.return_value = (self.fake_iscsi_attribute_scan, None)
+    @mock.patch('cinder.privsep.targets.scst.run_scstadmin')
+    def test_target_attribute(self, mock_privsep):
+        mock_privsep.return_value = (self.fake_iscsi_attribute_scan, None)
         self.assertEqual(str(1), self.target._target_attribute(
             'iqn.2010-10.org.openstack:'
             'volume-ed2c2222-5fc0-11e4-aa15-123b93f75cba'))

cinder/volume/targets/scst.py

@@ -15,7 +15,7 @@ from oslo_log import log as logging
 
 from cinder import exception
 from cinder.i18n import _
-from cinder import utils
+import cinder.privsep.targets.scst
 from cinder.volume.targets import iscsi
 from cinder.volume import utils as vutils
 
@@ -37,7 +37,7 @@ class SCSTAdm(iscsi.ISCSITarget):
         self.remove_initiator_iqn = None
 
     def scst_execute(self, *args):
-        return utils.execute('scstadmin', *args, run_as_root=True)
+        return cinder.privsep.targets.scst.run_scstadmin(*args)
 
     def validate_connector(self, connector):
         # iSCSI drivers require the initiator information

etc/cinder/rootwrap.d/volume.filters

@@ -8,7 +8,6 @@ tgtadm: CommandFilter, tgtadm, root
 iscsictl: CommandFilter, iscsictl, root
 tgt-admin: CommandFilter, tgt-admin, root
 cinder-rtstool: CommandFilter, cinder-rtstool, root
-scstadmin: CommandFilter, scstadmin, root
 
 # LVM related show commands
 pvs: EnvFilter, env, root, LC_ALL=C, pvs