openstack/os-brick
Code Issues Proposed changes

Remove usage of the "VIRTUAL_ENV" environment variable

Browse Source 
In the privsep file, we limit capabilities, and only if the
environment variable "VIRTUAL_ENV" is set, we add the
c.CAP_DAC_READ_SEARCH capability.

This makes deployment very difficult in Docker environments (e.g., Kolla).
Looking at Nova and Cinder privsep, this condition does not exist.

Change-Id: I0e0d6275bbd7695f836b40d462ef12aa27757968
This commit is contained in:
yuval
2025-02-25 15:08:42 +02:00
parent 6e83ac6eee
commit e0460dea1b
1 changed files with 1 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
os_brick/privileged/__init__.py
View File

@@ -10,19 +10,11 @@
# License for the specific language governing permissions and limitations
# under the License.
import os
from oslo_privsep import capabilities as c
from oslo_privsep import priv_context
capabilities = [c.CAP_SYS_ADMIN]
# On virtual environments libraries are not owned by the Daemon user (root), so
# the Daemon needs the capability to bypass file read permission checks in
# order to dynamically load the code to run.
if os.environ.get('VIRTUAL_ENV'):
capabilities.append(c.CAP_DAC_READ_SEARCH)
capabilities = [c.CAP_SYS_ADMIN, c.CAP_DAC_READ_SEARCH]
# It is expected that most (if not all) os-brick operations can be
# executed with these privileges.