Fix gate to use world writeable docker socket

A recent change related to sudo securepath broke how sudo -E
works.  Now the PATH is reset by sudo as set by tox.  As a result
we can no longer rely on sudo -E anywhere in our gating system
relating to path inheritence from the parent shell.

This patch uses a shell operation in the setup_nodes.yml code
to chmod the docker socket to 666 so docker containers can build
properly.  Now docker operations don't return a permission denied
and we no longer require the sudo -E operation in any of our tox
scripts.  This isn't a security vulnerability because our gate
scripts are only meant to be run in OpenStack infrastructure.
To make this more clear I recommend moving these shell scripts to
tests/gate.

Change-Id: I5b3d6e280e3c12a25defedb14b5589ba642043fa
Closes-Bug: #1562383
This commit is contained in:
Steven Dake 2016-03-26 10:11:32 -07:00
parent bd5d38ef3c
commit a789346727
2 changed files with 14 additions and 17 deletions

View File

@ -26,3 +26,6 @@
- name: Run node setup - name: Run node setup
shell: sudo /tmp/setup.sh shell: sudo /tmp/setup.sh
- name: Changing permissions of docker socket to 666
shell: sudo chmod 0666 /run/docker.sock

28
tox.ini
View File

@ -42,61 +42,56 @@ commands =
[testenv:build-centos-binary] [testenv:build-centos-binary]
whitelist_externals = find whitelist_externals = find
bash bash
sudo
setenv = setenv =
DOCKER_BUILD_TEST=1 DOCKER_BUILD_TEST=1
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.BuildTestCentosBinary testr run test_build.BuildTestCentosBinary
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
[testenv:build-centos-source] [testenv:build-centos-source]
whitelist_externals = find whitelist_externals = find
bash bash
sudo
setenv = setenv =
DOCKER_BUILD_TEST=1 DOCKER_BUILD_TEST=1
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.BuildTestCentosSource testr run test_build.BuildTestCentosSource
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
[testenv:build-ubuntu-source] [testenv:build-ubuntu-source]
whitelist_externals = find whitelist_externals = find
bash bash
sudo
setenv = setenv =
DOCKER_BUILD_TEST=1 DOCKER_BUILD_TEST=1
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.BuildTestUbuntuSource testr run test_build.BuildTestUbuntuSource
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
[testenv:build-oraclelinux-binary] [testenv:build-oraclelinux-binary]
whitelist_externals = find whitelist_externals = find
bash bash
sudo
setenv = setenv =
DOCKER_BUILD_TEST=1 DOCKER_BUILD_TEST=1
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.BuildTestOracleLinuxBinary testr run test_build.BuildTestOracleLinuxBinary
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
[testenv:build-oraclelinux-source] [testenv:build-oraclelinux-source]
whitelist_externals = find whitelist_externals = find
bash bash
sudo
setenv = setenv =
DOCKER_BUILD_TEST=1 DOCKER_BUILD_TEST=1
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.BuildTestOracleLinuxSource testr run test_build.BuildTestOracleLinuxSource
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
[testenv:deploy-centos-binary] [testenv:deploy-centos-binary]
@ -108,7 +103,7 @@ setenv =
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.DeployTestCentosBinary testr run test_build.DeployTestCentosBinary
sudo {toxinidir}/tools/deploy_aio.sh centos binary sudo {toxinidir}/tools/deploy_aio.sh centos binary
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
@ -121,7 +116,7 @@ setenv =
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.DeployTestCentosSource testr run test_build.DeployTestCentosSource
sudo {toxinidir}/tools/deploy_aio.sh centos source sudo {toxinidir}/tools/deploy_aio.sh centos source
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
@ -134,7 +129,7 @@ setenv =
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.DeployTestOracleLinuxBinary testr run test_build.DeployTestOracleLinuxBinary
sudo {toxinidir}/tools/deploy_aio.sh oraclelinux binary sudo {toxinidir}/tools/deploy_aio.sh oraclelinux binary
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
@ -147,7 +142,7 @@ setenv =
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.DeployTestOracleLinuxSource testr run test_build.DeployTestOracleLinuxSource
sudo {toxinidir}/tools/deploy_aio.sh oraclelinux source sudo {toxinidir}/tools/deploy_aio.sh oraclelinux source
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
@ -160,20 +155,19 @@ setenv =
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.DeployTestUbuntuSource testr run test_build.DeployTestUbuntuSource
sudo {toxinidir}/tools/deploy_aio.sh ubuntu source sudo {toxinidir}/tools/deploy_aio.sh ubuntu source
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
[testenv:deploy-multinode-ubuntu-source] [testenv:deploy-multinode-ubuntu-source]
whitelist_externals = find whitelist_externals = find
bash bash
sudo
setenv = setenv =
DOCKER_BUILD_TEST=1 DOCKER_BUILD_TEST=1
commands = commands =
find . -type f -name "*.pyc" -delete find . -type f -name "*.pyc" -delete
bash -c "if [ ! -d .testrepository ]; then testr init; fi" bash -c "if [ ! -d .testrepository ]; then testr init; fi"
sudo -E -g docker testr run test_build.BuildTestUbuntuSource testr run test_build.BuildTestUbuntuSource
{toxinidir}/tools/dump_info.sh {toxinidir}/tools/dump_info.sh
[testenv:genconfig] [testenv:genconfig]