openstack-ansible-os_nova/templates/sudoers.j2
Mohammed Naser 8e48646eb6 Add privsep-helper to nova sudoers file
With the new oslo-privsep library, there is now a
privsep-helper command that is used to escalate
privledges.

This command needs to be runnable by the nova user
via sudo without a password. The old rootwrap command
is still used as well, so for now we need to have
both.

Change-Id: I3bf334bf9498f67a1e91041d1d50870964e6141c
2019-03-31 21:24:27 -04:00

8 lines
382 B
Django/Jinja

# {{ ansible_managed }}
Defaults:{{ nova_system_user_name }} !requiretty
Defaults:{{ nova_system_user_name }} secure_path="{{ nova_bin }}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
{{ nova_system_user_name }} ALL = (root) NOPASSWD: {{ nova_bin }}/{{ nova_service_name }}-rootwrap
{{ nova_system_user_name }} ALL = (root) NOPASSWD: {{ nova_bin }}/privsep-helper