x/python-ganttclient
Code Issues Proposed changes

* Removes rogue direct usage of subprocess module by proper utils.execute calls

Browse Source 
* Adds a run_as_root parameter to utils.execute, that prefixes your command with FLAG.root_helper (which defaults to 'sudo')
* Turns all sudo calls into run_as_root=True calls
* Update fakes accordingly
* Replaces usage of "sudo -E" and "addl_env" parameter into passing environment in the command (allows it to be compatible with alternative sudo_helpers)
* Additionally, forces close_fds=True on all utils.execute calls, since it's a more secure default
This commit is contained in:
Thierry Carrez
2011-08-11 12:34:04 +00:00
committed by Tarmac
parent e403cc4dbf f90c4c12a9
commit 1b6b8e12c1
4 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
nova/flags.py
View File

@@ -392,3 +392,6 @@ DEFINE_bool('start_guests_on_host_boot', False,
'Whether to restart guests when the host reboots') 'Whether to restart guests when the host reboots')
DEFINE_bool('resume_guests_state_on_host_boot', False, DEFINE_bool('resume_guests_state_on_host_boot', False,
'Whether to start guests, that was running before the host reboot') 'Whether to start guests, that was running before the host reboot')
DEFINE_string('root_helper', 'sudo',
'Command prefix to use for running commands as root')

10
nova/tests/test_libvirt.py
View File

@@ -921,18 +921,18 @@ class IptablesFirewallTestCase(test.TestCase):
# self.fw.add_instance(instance_ref) # self.fw.add_instance(instance_ref)
def fake_iptables_execute(*cmd, **kwargs): def fake_iptables_execute(*cmd, **kwargs):
process_input = kwargs.get('process_input', None) process_input = kwargs.get('process_input', None)
if cmd == ('sudo', 'ip6tables-save', '-t', 'filter'): if cmd == ('ip6tables-save', '-t', 'filter'):
return '\n'.join(self.in6_filter_rules), None return '\n'.join(self.in6_filter_rules), None
if cmd == ('sudo', 'iptables-save', '-t', 'filter'): if cmd == ('iptables-save', '-t', 'filter'):
return '\n'.join(self.in_filter_rules), None return '\n'.join(self.in_filter_rules), None
if cmd == ('sudo', 'iptables-save', '-t', 'nat'): if cmd == ('iptables-save', '-t', 'nat'):
return '\n'.join(self.in_nat_rules), None return '\n'.join(self.in_nat_rules), None
if cmd == ('sudo', 'iptables-restore'): if cmd == ('iptables-restore',):
lines = process_input.split('\n') lines = process_input.split('\n')
if '*filter' in lines: if '*filter' in lines:
self.out_rules = lines self.out_rules = lines
return '', '' return '', ''
if cmd == ('sudo', 'ip6tables-restore'): if cmd == ('ip6tables-restore',):
lines = process_input.split('\n') lines = process_input.split('\n')
if '*filter' in lines: if '*filter' in lines:
self.out6_rules = lines self.out6_rules = lines

10
nova/tests/test_volume.py
View File

@@ -414,8 +414,9 @@ class ISCSITestCase(DriverTestCase):
self.mox.StubOutWithMock(self.volume.driver, '_execute') self.mox.StubOutWithMock(self.volume.driver, '_execute')
for i in volume_id_list: for i in volume_id_list:
tid = db.volume_get_iscsi_target_num(self.context, i) tid = db.volume_get_iscsi_target_num(self.context, i)
self.volume.driver._execute("sudo", "ietadm", "--op", "show", self.volume.driver._execute("ietadm", "--op", "show",
"--tid=%(tid)d" % locals()) "--tid=%(tid)d" % locals(),
run_as_root=True)
self.stream.truncate(0) self.stream.truncate(0)
self.mox.ReplayAll() self.mox.ReplayAll()
@@ -433,8 +434,9 @@ class ISCSITestCase(DriverTestCase):
# the first vblade process isn't running # the first vblade process isn't running
tid = db.volume_get_iscsi_target_num(self.context, volume_id_list[0]) tid = db.volume_get_iscsi_target_num(self.context, volume_id_list[0])
self.mox.StubOutWithMock(self.volume.driver, '_execute') self.mox.StubOutWithMock(self.volume.driver, '_execute')
self.volume.driver._execute("sudo", "ietadm", "--op", "show", self.volume.driver._execute("ietadm", "--op", "show",
"--tid=%(tid)d" % locals()).AndRaise( "--tid=%(tid)d" % locals(),
run_as_root=True).AndRaise(
exception.ProcessExecutionError()) exception.ProcessExecutionError())
self.mox.ReplayAll() self.mox.ReplayAll()

10
nova/tests/test_xenapi.py
View File

@@ -548,8 +548,8 @@ class XenAPIVMTestCase(test.TestCase):
return '', '' return '', ''
fake_utils.fake_execute_set_repliers([ fake_utils.fake_execute_set_repliers([
# Capture the sudo tee .../etc/network/interfaces command # Capture the tee .../etc/network/interfaces command
(r'(sudo\s+)?tee.*interfaces', _tee_handler), (r'tee.*interfaces', _tee_handler),
]) ])
self._test_spawn(glance_stubs.FakeGlance.IMAGE_MACHINE, self._test_spawn(glance_stubs.FakeGlance.IMAGE_MACHINE,
glance_stubs.FakeGlance.IMAGE_KERNEL, glance_stubs.FakeGlance.IMAGE_KERNEL,
@@ -592,9 +592,9 @@ class XenAPIVMTestCase(test.TestCase):
return '', '' return '', ''
fake_utils.fake_execute_set_repliers([ fake_utils.fake_execute_set_repliers([
(r'(sudo\s+)?mount', _mount_handler), (r'mount', _mount_handler),
(r'(sudo\s+)?umount', _umount_handler), (r'umount', _umount_handler),
(r'(sudo\s+)?tee.*interfaces', _tee_handler)]) (r'tee.*interfaces', _tee_handler)])
self._test_spawn(1, 2, 3, check_injection=True) self._test_spawn(1, 2, 3, check_injection=True)
# tee must not run in this case, where an injection-capable # tee must not run in this case, where an injection-capable