909d0de68e
Thanks to mikal, nova was fully transitioned to using privsep over the past cycles. However the old rootwrap filter definitions have been left behind, which basically means that there is limited security benefit right now (code gone rogue could still call rootwrap to execute some code as root). As far as I can tell, those can be removed now. os-brick calls in compute.filters should be covered by the os_brick.privileged.default context. Rootwrap is now only used to launch the two privileged privsep contexts. Since those are one-shot at the start of the service, there is little point in using rootwrap-daemon on nova nodes. network.filters and api-metadata.filters are being removed in https://review.opendev.org/#/c/696518 as part of the nova-net cleanup. Change-Id: Ie5e5ab17dabad713d4ad1261ab8b5d62b017f31e
10 lines
612 B
XML
10 lines
612 B
XML
# nova-rootwrap command filters for compute nodes
|
|
# This file should be owned by (and only-writeable by) the root user
|
|
|
|
[Filters]
|
|
# os_brick.privileged.default oslo.privsep context
|
|
privsep-rootwrap-os_brick: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*
|
|
|
|
# nova.privsep.sys_admin_pctxt oslo.privsep context
|
|
privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.*
|