Add rootwrap filters

This patch adds os-bricks list of rootwrap filters for commands
that are needed to execute.   The filters are a self contained entire
list of expected filters that os-brick needs to run.  It's expected that
this filter file is added to any rootwrap enabled service that needs to use

Devstack associated patch:

Partial-Bug: #1479842
UpgradeImpact:  Need to place the os-brick.filters file in service's
                rootwrap.d directory to enable filters.

Change-Id: I2b1e657b87c7b27548200a20b991f34c3413c24b
This commit is contained in:
Walter A. Boring IV 2015-07-30 10:19:04 -07:00
parent bc5d18f234
commit c16abad3d8
2 changed files with 65 additions and 0 deletions

View File

@ -0,0 +1,63 @@
# os-brick command filters
# This file should be owned by (and only-writeable by) the root user
# remotefs/ 'mount', '-t', 'sofs' ...
mount: CommandFilter, mount, root
# initiator/ 'blockdev', '--flushbufs', device
blockdev: RegExpFilter, blockdev, root, blockdev, (--getsize64|--flushbufs), /dev/.*
# initiator/ 'tee', canonpath
tee: CommandFilter, tee, root
# remotefs/ 'mkdir', canonpath
mkdir: CommandFilter, mkdir, root
# remotefs/ 'chown', '-R', 'root'
chown: RegExpFilter, chown, root, chown root:root /etc/pstorage/clusters/(?!.*/\.\.).*
# initiator/ 'ip', 'addr', 'list'
ip: CommandFilter, ip, root
# initiator/ 'dd', if=%(path)s % ("path": path}
dd: CommandFilter, dd, root
# initiator/ 'iscsiadm', '-m', ...
iscsiadm: CommandFilter, iscsiadm, root
# initiator/ 'aoe-revalidate', aoedev
# initiator/ 'aoe-discover'
# initiator/ 'aoe-flush'
aoe-revalidate: CommandFilter, aoe-revalidate, root
aoe-discover: CommandFilter, aoe-discover, root
aoe-flush: CommandFilter, aoe-flush, root
# initiator/
read_initiator: ReadFileFilter, /etc/iscsi/initiatorname.iscsi
# initiator/ 'multipath', '-ll'
# initiator/ 'multipath', '-ll'
multipath: CommandFilter, multipath, root
# initiator/ 'multipathd', 'show', 'status'
multipathd: CommandFilter, multipathd, root
# initiator/ 'systool', '-c', 'fc_host', '-v'
systool: CommandFilter, systool, root
# initiator/ 'sg_scan', device
sg_scan: CommandFilter, sg_scan, root
# remotefs/ 'cp', '-f', tmp_bs_path
cp: CommandFilter, cp, root
# initiator/
drv_cfg: CommandFilter, /opt/emc/scaleio/sdc/bin/drv_cfg, root, /opt/emc/scaleio/sdc/bin/drv_cfg, --query_guid
# initiator/
sds_cli: CommandFilter, /usr/local/bin/sds/sds_cli, root
# initiator/ 'vgs-cluster', 'domain-list', '-l'
# initiator/ 'vgs-cluster', 'space-set-apphosts', '-n'...
vgs-cluster: CommandFilter, vgs-cluster, root

View File

@ -27,6 +27,8 @@ setup-hooks =
packages =
data_files =
etc/ = etc/*
tag_build =