780a4c4ead
Major changes: * Plumbing necessary for strict confinement with the microstack-support interface https://github.com/snapcore/snapd/pull/8926 * Until the interface is merged, devmode will be used and kernel modules will be loaded via an auxiliary service. * upgraded OpenStack components to Focal (20.04) and OpenStack Ussuri; * reworked the old patches; * added the Placement service since it is now separate; * addressed various build issues due to changes in snapcraft and built dependencies: * e.g. libvirt requires the build directory to be separate from the source directory) and LP: #1882255; * LP: #1882535 and https://github.com/pypa/pip/issues/8414 * LP: #1882839 * LP: #1885294 * https://storyboard.openstack.org/#!/story/2007806 * LP: #1864589 * LP: #1777121 * LP: #1881590 * ML2/OVS replated with ML2/OVN; * dnsmasq is not used anymore; * neutron l3 and DHCP agents are not used anymore; * Linux network namespaces are only used for neutron-ovn-metadata-agent. * ML2 DNS support is done via native OVN mechanisms; * OVN-related database services (southbound and northbound dbs); * OVN-related control plane services (ovn-controller, ovn-northd); * core20 base support (bionic hosts are supported); * the removal procedure now relies on the "remove" hook since `snap remove` cannot be used from the confined environment anymore; * prerequisites to enabling AppArmor confinement for QEMU processes created by the confined libvirtd. * Added the Spice html5 console proxy service to enable clients to retrieve and use it via `microstack.openstack console url show --spice <servername>`. * Added missing Cinder templates and DB migrations for the Cinder DB. * Added experimental support for a loop device-based LVM backend for Cinder. Due to LP: #1892895 this is not recommended to be used in production except for tempest testing with an applied workaround; * includes iscsid and iscsi-tcp kernel module loading; * includes LIO and loading of relevant kernel modules; * An LVM PV is created on top of a loop device with a backing file present in $SNAP_COMMON/cinder-lvm.img; * A VG is created on top of the PV; * LVs are created by Cinder and exported via LIO over iscsi to iscsid which hot-plugs new SCSI devices. Those SCSI devices are then propagated by Nova to libvirt and QEMU during volume attachment; * Added post-deployment testing via rally and tempest (via the microstack-test snap). A set of tests included into Refstack 2018.02 is executed (except for object storage tests due to the lack of object storage support). Change-Id: Ic70770095860a57d5e0a55a8a9451f9db6be7448
78 lines
2.5 KiB
Diff
78 lines
2.5 KiB
Diff
From a8df30a8a837c223945a13fe4cd9418084d8ed21 Mon Sep 17 00:00:00 2001
|
|
From: Dmitrii Shcherbakov <dmitrii.shcherbakov@canonical.com>
|
|
Date: Wed, 10 Jun 2020 20:14:32 +0000
|
|
Subject: [PATCH] drop setuid/setgid/initgroups
|
|
|
|
---
|
|
src/os/unix/ngx_process_cycle.c | 54 ---------------------------------
|
|
1 file changed, 54 deletions(-)
|
|
|
|
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
|
|
index 5817a2c2..305c6823 100644
|
|
--- a/src/os/unix/ngx_process_cycle.c
|
|
+++ b/src/os/unix/ngx_process_cycle.c
|
|
@@ -825,60 +825,6 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker)
|
|
}
|
|
}
|
|
|
|
- if (geteuid() == 0) {
|
|
- if (setgid(ccf->group) == -1) {
|
|
- ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
|
|
- "setgid(%d) failed", ccf->group);
|
|
- /* fatal */
|
|
- exit(2);
|
|
- }
|
|
-
|
|
- if (initgroups(ccf->username, ccf->group) == -1) {
|
|
- ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
|
|
- "initgroups(%s, %d) failed",
|
|
- ccf->username, ccf->group);
|
|
- }
|
|
-
|
|
-#if (NGX_HAVE_PR_SET_KEEPCAPS && NGX_HAVE_CAPABILITIES)
|
|
- if (ccf->transparent && ccf->user) {
|
|
- if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
|
|
- ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
|
|
- "prctl(PR_SET_KEEPCAPS, 1) failed");
|
|
- /* fatal */
|
|
- exit(2);
|
|
- }
|
|
- }
|
|
-#endif
|
|
-
|
|
- if (setuid(ccf->user) == -1) {
|
|
- ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
|
|
- "setuid(%d) failed", ccf->user);
|
|
- /* fatal */
|
|
- exit(2);
|
|
- }
|
|
-
|
|
-#if (NGX_HAVE_CAPABILITIES)
|
|
- if (ccf->transparent && ccf->user) {
|
|
- struct __user_cap_data_struct data;
|
|
- struct __user_cap_header_struct header;
|
|
-
|
|
- ngx_memzero(&header, sizeof(struct __user_cap_header_struct));
|
|
- ngx_memzero(&data, sizeof(struct __user_cap_data_struct));
|
|
-
|
|
- header.version = _LINUX_CAPABILITY_VERSION_1;
|
|
- data.effective = CAP_TO_MASK(CAP_NET_RAW);
|
|
- data.permitted = data.effective;
|
|
-
|
|
- if (syscall(SYS_capset, &header, &data) == -1) {
|
|
- ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
|
|
- "capset() failed");
|
|
- /* fatal */
|
|
- exit(2);
|
|
- }
|
|
- }
|
|
-#endif
|
|
- }
|
|
-
|
|
if (worker >= 0) {
|
|
cpu_affinity = ngx_get_cpu_affinity(worker);
|
|
|
|
--
|
|
2.17.1
|
|
|