openstack/ironic-inspector
Code Issues Proposed changes

Remove rootwrap rule for dnsmasq systemctl

Browse Source 
The systemd service named openstack-ironic-inspector-dnsmasq is a name
which was only ever used by TripleO and hasn't been used since before
Train when the services were containerized and the dnsmasq process
management was no longer handled by inspector at all.

This change removes this rootwrap rule as unused for some years. Any
configuration tool which is setting
[dnsmasq_pxe_filter]dnsmasq_start_command also needs to be writing an
appropriate rootwrap.d file, as the inspector devstack plugin does.

Change-Id: I38974faa8897daabf88ff63402d42a3ef93e675c
This commit is contained in:
Steve Baker 2021-12-21 15:09:05 +13:00 committed by Julia Kreger
parent fe32ebdfea
commit a72289fbe7
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
releasenotes/notes/rootwrap-removal-68af457a0104a2ba.yaml Normal file
View File

@ -0,0 +1,9 @@
---
upgrade:
- |
The rootwrap rule to allow restarting the systemd service
openstack-ironic-inspector-dnsmasq.service has been removed. No known
tooling requires this rule since before Train. Any configuration tool which
is setting [dnsmasq_pxe_filter]dnsmasq_start_command also needs to be
writing an appropriate rootwrap.d file, as the inspector devstack plugin
does.

4
rootwrap.d/ironic-inspector.filters
View File

@ -5,7 +5,3 @@
# ironic_inspector/pxe_filter/iptables.py
iptables: CommandFilter, iptables, root
ip6tables: CommandFilter, ip6tables, root
# ironic-inspector-rootwrap command filters for systemctl manipulation of the dnsmasq service
# ironic_inspector/pxe_filter/dnsmasq.py
systemctl: RegExpFilter, /bin/systemctl, root, systemctl, .*, openstack-ironic-inspector-dnsmasq.service