openstack/ironic-inspector
Code Issues Proposed changes

Merge "Add rootwrap filter for systemctl control of dnsmasq"

Browse Source
This commit is contained in:
Zuul 2018-08-23 15:20:09 +00:00 committed by Gerrit Code Review
commit 56138d8f06
3 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
releasenotes/notes/dnsmask-pxe-filter-rootwrap-systemctl-099964ad39d38b4c.yaml Normal file
View File

@ -0,0 +1,11 @@
---
fixes:
- |
A new rootwrap filter is now included to allow control of the systemd
dnsmasq service used by ironic-inspector. This fixes a permission issue
when systemctl commands are used as ``dnsmasq_start_command`` and
``dnsmasq_stop_command`` in the configuration for the dnsmasq pxe filter.
See bug `2002818 <https://storyboard.openstack.org/#!/story/2002818>`_.
.. Note:: The filter uses the systemd service name used by the RDO
distrubution (``openstack-ironic-inspector-dnsmasq.service``).

6
rootwrap.d/ironic-inspector-firewall.filters
View File

@ -1,6 +0,0 @@
# ironic-inspector-rootwrap command filters for firewall manipulation
# This file should be owned by (and only-writeable by) the root user
[Filters]
# ironic_inspector/firewall.py
iptables: CommandFilter, iptables, root

10
rootwrap.d/ironic-inspector.filters Normal file
View File

@ -0,0 +1,10 @@
# This file should be owned by (and only-writeable by) the root user
[Filters]
# ironic-inspector-rootwrap command filters for firewall manipulation
# ironic_inspector/firewall.py
iptables: CommandFilter, iptables, root
# ironic-inspector-rootwrap command filters for systemctl manipulation of the dnsmasq service
# ironic_inspector/pxe_filter/dnsmasq.py
systemctl: RegExpFilter, /bin/systemctl, root, systemctl, .*, openstack-ironic-inspector-dnsmasq.service