From b54420442ef1a4d7a39e4f868a8a8d76e593f510 Mon Sep 17 00:00:00 2001 From: Kuo-tung Kao Date: Tue, 22 Dec 2015 14:48:24 +0800 Subject: [PATCH] change libvirt sock group to nova Add `nova` user to nova-libvirt container. And change libvirt-socket group to nova. Change-Id: I183c83f4be8b1d7c75d4ac204df7b7e059626aa2 Closes-Bug: #1525583 --- ansible/roles/nova/templates/libvirtd.conf.j2 | 2 +- docker/nova/nova-libvirt/Dockerfile.j2 | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/ansible/roles/nova/templates/libvirtd.conf.j2 b/ansible/roles/nova/templates/libvirtd.conf.j2 index d7a127a613..93137e798d 100644 --- a/ansible/roles/nova/templates/libvirtd.conf.j2 +++ b/ansible/roles/nova/templates/libvirtd.conf.j2 @@ -4,7 +4,7 @@ ca_file = "" log_level = 2 log_outputs = "2:file:/var/log/libvirt/libvirtd.log" listen_addr = "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" -unix_sock_group = "root" +unix_sock_group = "nova" unix_sock_ro_perms = "0777" unix_sock_rw_perms = "0770" auth_unix_ro = "none" diff --git a/docker/nova/nova-libvirt/Dockerfile.j2 b/docker/nova/nova-libvirt/Dockerfile.j2 index 341aeb0b03..19f6053ce1 100644 --- a/docker/nova/nova-libvirt/Dockerfile.j2 +++ b/docker/nova/nova-libvirt/Dockerfile.j2 @@ -30,8 +30,7 @@ RUN apt-get install -y --no-install-recommends \ {% endif %} COPY extend_start.sh /usr/local/bin/kolla_extend_start -RUN chmod 755 /usr/local/bin/kolla_extend_start +RUN chmod 755 /usr/local/bin/kolla_extend_start \ + && useradd --user-group nova -{{ include_footer }} - -# TODO(coolsvap/nihilifer): Run libvirt daemon as non-root user. +{{ include_footer }} \ No newline at end of file