33 lines
1.5 KiB
XML
33 lines
1.5 KiB
XML
# neutron-rootwrap command filters to support functional testing. It
|
|
# is NOT intended to be used outside of a test environment.
|
|
#
|
|
# This file should be owned by (and only-writeable by) the root user
|
|
|
|
[Filters]
|
|
# enable ping from namespace
|
|
ping_filter: CommandFilter, ping, root
|
|
ping6_filter: CommandFilter, ping6, root
|
|
|
|
# enable curl from namespace
|
|
curl_filter: RegExpFilter, /usr/bin/curl, root, curl, --max-time, \d+, -D-, http://[0-9a-z:./-]+
|
|
nc_filter: CommandFilter, nc, root
|
|
# netcat has different binaries depending on linux distribution
|
|
nc_kill: KillFilter, root, nc, -9
|
|
ncbsd_kill: KillFilter, root, nc.openbsd, -9
|
|
ncat_kill: KillFilter, root, ncat, -9
|
|
ss_filter: CommandFilter, ss, root
|
|
|
|
# enable dhclient from namespace
|
|
dhclient_filter: CommandFilter, dhclient, root
|
|
dhclient_kill: KillFilter, root, dhclient, -9
|
|
|
|
# Actually, dhclient is used for test dhcp-agent and runs
|
|
# in dhcp-agent namespace. If in that namespace resolv.conf file not exist
|
|
# dhclient will override system /etc/resolv.conf
|
|
# Filters below are limit functions mkdir, rm and touch
|
|
# only to create and delete file resolv.conf in the that namespace
|
|
mkdir_filter: RegExpFilter, /bin/mkdir, root, mkdir, -p, /etc/netns/qdhcp-[0-9a-z./-]+
|
|
rm_filter: RegExpFilter, /bin/rm, root, rm, -r, /etc/netns/qdhcp-[0-9a-z./-]+
|
|
touch_filter: RegExpFilter, /bin/touch, root, touch, /etc/netns/qdhcp-[0-9a-z./-]+/resolv.conf
|
|
touch_filter: RegExpFilter, /usr/bin/touch, root, touch, /etc/netns/qdhcp-[0-9a-z./-]+/resolv.conf
|