Michael Still
e90c2ba868
Its the end of the road. Change-Id: Ic966bc5f56e578ddf775acbf6e82dbe281fd5ffa
25 lines
1.3 KiB
XML
25 lines
1.3 KiB
XML
# nova-rootwrap command filters for compute nodes
|
|
# This file should be owned by (and only-writeable by) the root user
|
|
|
|
[Filters]
|
|
|
|
# os-brick needed commands
|
|
read_initiator: ReadFileFilter, /etc/iscsi/initiatorname.iscsi
|
|
multipath: CommandFilter, multipath, root
|
|
# multipathd show status
|
|
multipathd: CommandFilter, multipathd, root
|
|
systool: CommandFilter, systool, root
|
|
vgc-cluster: CommandFilter, vgc-cluster, root
|
|
# os_brick/initiator/connector.py
|
|
drv_cfg: CommandFilter, /opt/emc/scaleio/sdc/bin/drv_cfg, root, /opt/emc/scaleio/sdc/bin/drv_cfg, --query_guid
|
|
|
|
# TODO(smcginnis) Temporary fix.
|
|
# Need to pull in os-brick os-brick.filters file instead and clean
|
|
# out stale brick values from this file.
|
|
scsi_id: CommandFilter, /lib/udev/scsi_id, root
|
|
# os_brick.privileged.default oslo.privsep context
|
|
# This line ties the superuser privs with the config files, context name,
|
|
# and (implicitly) the actual python code invoked.
|
|
privsep-rootwrap-os_brick: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*
|
|
|
|
privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.* |