5d5f8e02ef
When running os-brick in a virtual environment created by a non root user, we get the following error: ModuleNotFoundError: No module named 'os_brick.privileged.rootwrap' This happens because the privsep daemon drops all the privileged except those defined in the context, and our current context doesn't bypass file read permission checks, so the Daemon cannot read the file with the code it was asked to run, because it belongs to a different user. This patch adds the CAP_DAC_READ_SEARCH capability to our privsep context so we can load the libraries, but only when we are running on a virtual environment to follow the principle of least privilege. This bug doesn't affect system-wide installations because the files installed under /sys/python*/site-packages belong to the Daemon user (root), so no special capabilities are necessary. Change-Id: Ib191c075ad1250822f6ac842f39214af8f3a02f0 Close-Bug: #1884059
Team and repository tags
brick
OpenStack Cinder brick library for managing local volume attaches
Features
- Discovery of volumes being attached to a host for many transport protocols.
- Removal of volumes from a host.
Hacking
Hacking on brick requires python-gdbm (for Debian derived distributions), Python 2.7 and Python 3.4. A recent tox is required, as is a recent virtualenv (13.1.0 or newer).
If "tox -e py34" fails with the error "db type could not be determined", remove the .testrepository/ directory and then run "tox -e py34".
- For any other information, refer to the developer documents:
- OR refer to the parent project, Cinder:
- Release notes for the project can be found at:
- License: Apache License, Version 2.0
- Source: https://opendev.org/openstack/os-brick
- Bugs: https://bugs.launchpad.net/os-brick