mooli tayer has uploaded a new change for review.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
vdsm-tool: changing root checking in configurator.
Checking for root as we currently do in configure of libvirt and sanlock is not enough. Currently this will fail during the isConfigured() check since it does not have premissions to the files it attempts to check: "OSError: No such file or directory: /etc/libvirt/libvirtd.conf"
It is easy to see that this check is needed for all the exposed methods of configurator. I'm suggesting to do it in the exposed verbs in a uniform manner.
Change-Id: I52967e30f677e4537b83c2db442963e3eadecb55 Signed-off-by: Mooli Tayer mtayer@redhat.com --- M lib/vdsm/tool/configurator.py 1 file changed, 16 insertions(+), 6 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/93/31293/1
diff --git a/lib/vdsm/tool/configurator.py b/lib/vdsm/tool/configurator.py index 8136613..475fa62 100644 --- a/lib/vdsm/tool/configurator.py +++ b/lib/vdsm/tool/configurator.py @@ -20,6 +20,7 @@ import argparse import errno import filecmp +import functools import grp import os import pwd @@ -105,9 +106,6 @@ return ["vdsmd", "supervdsmd", "libvirtd"]
def configure(self): - if os.getuid() != 0: - raise NotRootError() - self._sysvToUpstart()
if utils.isOvirtNode(): @@ -607,9 +605,6 @@ """ Configure sanlock process groups """ - if os.getuid() != 0: - raise NotRootError() - rc, out, err = utils.execCmd( ( '/usr/sbin/usermod', @@ -678,13 +673,25 @@ )
+def assertRoot(func): + @functools.wraps(func) + def inner(*args, **kwargs): + if os.getuid() != 0: + raise NotRootError() + func(*args, **kwargs) + return inner + + @expose("configure") +@assertRoot def configure(*args): """ configure [-h|...] Configure external services for vdsm Invoke with -h for complete usage. """ + + args = _parse_args(*args) configurer_to_trigger = []
@@ -726,6 +733,7 @@
@expose("is-configured") +@assertRoot def isconfigured(*args): """ is-configured [-h|...] @@ -763,6 +771,7 @@
@expose("validate-config") +@assertRoot def validate_config(*args): """ validate-config [-h|...] @@ -788,6 +797,7 @@
@expose("remove-config") +@assertRoot def remove_config(*args): """ Remove vdsm configuration from conf files
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 1:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/1/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 689: configure [-h|...] Line 690: Configure external services for vdsm Line 691: Invoke with -h for complete usage. Line 692: """ Line 693: opps pep error here, fixed Line 694: Line 695: args = _parse_args(*args) Line 696: configurer_to_trigger = [] Line 697:
oVirt Jenkins CI Server has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 1: Code-Review-1 Verified-1
Build Unstable
http://jenkins.ovirt.org/job/vdsm_master_unit_tests_gerrit_el/10780/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_unit-tests_created/11722/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_pep8_gerrit/11565/ : UNSTABLE
Dima Kuznetsov has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 1:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/1/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 675: Line 676: def assertRoot(func): Line 677: @functools.wraps(func) Line 678: def inner(*args, **kwargs): Line 679: if os.getuid() != 0: I think it is better to use os.geteuid() Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return inner Line 683:
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 1:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/1/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 675: Line 676: def assertRoot(func): Line 677: @functools.wraps(func) Line 678: def inner(*args, **kwargs): Line 679: if os.getuid() != 0:
I think it is better to use os.geteuid()
Makes sense. I assume we should get no fall back from
changing this. (I think this matters only to setuid bit
proccess and other stuff not relevant to us.) Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return inner Line 683:
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 1:
(3 comments)
http://gerrit.ovirt.org/#/c/31293/1/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 672: SanlockModuleConfigure(), Line 673: ) Line 674: Line 675: Line 676: def assertRoot(func): I think that @requiresRoot is more clear. Line 677: @functools.wraps(func) Line 678: def inner(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError()
Line 674: Line 675: Line 676: def assertRoot(func): Line 677: @functools.wraps(func) Line 678: def inner(*args, **kwargs): Call it wrapper - this is how it is called almost everywhere. Line 679: if os.getuid() != 0: Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return inner
Line 675: Line 676: def assertRoot(func): Line 677: @functools.wraps(func) Line 678: def inner(*args, **kwargs): Line 679: if os.getuid() != 0:
Makes sense. I assume we should get no fall back from
Dima is correct, but do not change this in this patch. Do this in the next patch - this patch about checking for root in where needed, the next patch can fix the way we check for root. Lets keep logical changes separate. Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return inner Line 683:
oVirt Jenkins CI Server has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
Build Successful
http://jenkins.ovirt.org/job/vdsm_master_unit_tests_gerrit_el/10795/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_unit-tests_created/11737/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_pep8_gerrit/11580/ : SUCCESS
Dima Kuznetsov has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2: Code-Review+1
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 1:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/1//COMMIT_MSG Commit Message:
Line 3: AuthorDate: 2014-08-10 15:11:48 +0300 Line 4: Commit: Mooli Tayer mtayer@redhat.com Line 5: CommitDate: 2014-08-10 15:22:44 +0300 Line 6: Line 7: vdsm-tool: changing root checking in configurator. This is not a good title - your purpose is not the "change", but to add root check where it was missing. Line 8: Line 9: Checking for root as we currently do in configure of libvirt and Line 10: sanlock is not enough. Currently this will fail during the Line 11: isConfigured() check since it does not have premissions to the
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2: Verified+1
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 672: SanlockModuleConfigure(), Line 673: ) Line 674: Line 675: Line 676: def requiresRoot(func): Isn't this more generic utility that can be used in lot of other places in the tool?
I would keep this where @expose is kept. Line 677: @functools.wraps(func) Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError()
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 672: SanlockModuleConfigure(), Line 673: ) Line 674: Line 675: Line 676: def requiresRoot(func):
Isn't this more generic utility that can be used in lot of other places in
I think we need to move it there (__init__.py) only if other modules will need it. Line 677: @functools.wraps(func) Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError()
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 672: SanlockModuleConfigure(), Line 673: ) Line 674: Line 675: Line 676: def requiresRoot(func):
I think we need to move it there (__init__.py) only if other modules will n
This is how mess is started :-) Line 677: @functools.wraps(func) Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError()
Yaniv Bronhaim has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return wrapper you have same function in testValidation.py called ValidateRunningAsRoot. I'm not sure we need it mandatory for all the configures. in each configure function the developer can say if it should run as root or not. if you still not agree with me, I would add it into the origin class (_ModuleConfigure) and call super before starting each configure. common code part for all configures. Line 683: Line 684: Line 685: @expose("configure") Line 686: @requiresRoot
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return wrapper
you have same function in testValidation.py called ValidateRunningAsRoot. I
I think since the nature of configurators is to change configuration we should demand it here. I've also checked and libvirt and sanlock configure, validate, isconfigured and removeConf all require root permissions. is seems logical to me that if it is used here it will be put here I don't understand what's wrong with that. Line 683: Line 684: Line 685: @expose("configure") Line 686: @requiresRoot
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return wrapper
you have same function in testValidation.py called ValidateRunningAsRoot. I
I think a decorator as Mooli propose is the right way to handle this, and it can be a generic utility replacing all others places that check for root.
The decorator can be placed on the module verbs or on specific configurator methods, this is very flexible.
Adding this as a method the the base class is the wrong thing to do, as testValidation case prove - we need this in lot of places, this is not a method of the the module configurator. Line 683: Line 684: Line 685: @expose("configure") Line 686: @requiresRoot
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return wrapper
I think a decorator as Mooli propose is the right way to handle this, and i
Let me understand. do you propose to put this at utils? Line 683: Line 684: Line 685: @expose("configure") Line 686: @requiresRoot
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 2:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/2/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 678: def wrapper(*args, **kwargs): Line 679: if os.getuid() != 0: Line 680: raise NotRootError() Line 681: func(*args, **kwargs) Line 682: return wrapper
Let me understand.
No, this is generic solution for vdsm-tool. For vdsm, we run code that requires root using supervdsm, and we don't check if you are root in this code. We can mark such function with this decorator, but I don't think it worth the effort, since it is not an interactive tool. Line 683: Line 684: Line 685: @expose("configure") Line 686: @requiresRoot
oVirt Jenkins CI Server has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 3:
Build Successful
http://jenkins.ovirt.org/job/vdsm_master_unit_tests_gerrit_el/10881/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_unit-tests_created/11823/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_pep8_gerrit/11666/ : SUCCESS
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 3:
(1 comment)
Mooli, did you search for imports of NoRootError, and eliminated all places using @requiresRoot?
http://gerrit.ovirt.org/#/c/31293/3/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 38: SANLOCK_ENABLED, \ Line 39: SANLOCK_USER, \ Line 40: SYSCONF_PATH, \ Line 41: VDSM_GROUP Line 42: from . import NotRootError, requiresRoot, UsageError I think that you don't need NoRootError any more, unless you have duplicate code raising it :-) Line 43: from . import service, expose, validate_ovirt_certs Line 44: from .. import utils Line 45: from vdsm.config import config Line 46:
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 3:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/3/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 38: SANLOCK_ENABLED, \ Line 39: SANLOCK_USER, \ Line 40: SYSCONF_PATH, \ Line 41: VDSM_GROUP Line 42: from . import NotRootError, requiresRoot, UsageError
I think that you don't need NoRootError any more, unless you have duplicat
Correct. Line 43: from . import service, expose, validate_ovirt_certs Line 44: from .. import utils Line 45: from vdsm.config import config Line 46:
oVirt Jenkins CI Server has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4:
Build Successful
http://jenkins.ovirt.org/job/vdsm_master_unit_tests_gerrit_el/10917/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_unit-tests_created/11859/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_pep8_gerrit/11702/ : SUCCESS
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4: Code-Review+1
Yaniv Bronhaim has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4: Code-Review-1
(1 comment)
http://gerrit.ovirt.org/#/c/31293/4/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 672: ) Line 673: Line 674: Line 675: @expose("configure") Line 676: @requiresRoot and what if someone imports configurator and run LibvirtModuleConfigure.configure directly ?
I prefer this decorator only above functions that we know that require root Line 677: def configure(*args): Line 678: """ Line 679: configure [-h|...] Line 680: Configure external services for vdsm
Nir Soffer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/4/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 672: ) Line 673: Line 674: Line 675: @expose("configure") Line 676: @requiresRoot
and what if someone imports configurator and run LibvirtModuleConfigure.con
This module is not a library, but part of vdsm-tool. If you want to use in incorrectly, its your problem. Line 677: def configure(*args): Line 678: """ Line 679: configure [-h|...] Line 680: Configure external services for vdsm
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4:
(1 comment)
http://gerrit.ovirt.org/#/c/31293/4/lib/vdsm/tool/configurator.py File lib/vdsm/tool/configurator.py:
Line 672: ) Line 673: Line 674: Line 675: @expose("configure") Line 676: @requiresRoot
This module is not a library, but part of vdsm-tool. If you want to use in
Doing it this way will reduce chance of bags in the future.
Since vdsm-tool is a configuration tool It makes perfect sense to demand root in it's entry point. Line 677: def configure(*args): Line 678: """ Line 679: configure [-h|...] Line 680: Configure external services for vdsm
Yaniv Bronhaim has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4: Code-Review+1
ok, you're kinda right. convinced to cover all the configure part. but what about the is-configured?
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4:
Well, libvirt: tested this, it fails because '.../libvirtd.conf'
does not exist, no permissions...
sanlock: did not test but guessing the same about
'/var/run/sanlock/sanlock.pid'
'certificates': same about cert file.
I think we will be making our lives easier if we demand root for all and since this is a configuration tool we don't really lose anything...
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4: Verified+1
Dan Kenigsberg has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 4: Code-Review-1
needs manual rebase due to recent refactoring
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 5:
rebased on top of configurators reorganization.
oVirt Jenkins CI Server has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 5:
Build Failed
http://jenkins.ovirt.org/job/vdsm_master_unit_tests_gerrit_el/11101/ : FAILURE
http://jenkins.ovirt.org/job/vdsm_master_unit-tests_created/12043/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_pep8_gerrit/11890/ : SUCCESS
Dima Kuznetsov has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 5: Code-Review+1
mooli tayer has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 6: Verified+1
rebased + verified verified on rhel6.5: [mtayer@dhcp-0-214 vdsm]$ vdsm-tool configure --force Error: Must run as root [mtayer@dhcp-0-214 vdsm]$ vdsm-tool configure --module=libvirt --force Error: Must run as root [mtayer@dhcp-0-214 vdsm]$ vdsm-tool validate-config --force Error: Must run as root
oVirt Jenkins CI Server has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 6:
Build Successful
http://jenkins.ovirt.org/job/vdsm_master_unit_tests_gerrit_el/11226/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_unit-tests_created/12168/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_pep8_gerrit/12015/ : SUCCESS
Yaniv Bronhaim has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 6: Code-Review+1
Dan Kenigsberg has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 6: Code-Review+2
Raising
Dan Kenigsberg has submitted this change and it was merged.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
vdsm-tool: changing root checking in configurator.
Checking for root as we currently do in configure of libvirt and sanlock is not enough. Currently this will fail during the isConfigured() check since it does not have premissions to the files it attempts to check: "OSError: No such file or directory: /etc/libvirt/libvirtd.conf"
It is easy to see that this check is needed for all the exposed methods of configurator. I'm suggesting to do it in the exposed verbs in a uniform manner.
Change-Id: I52967e30f677e4537b83c2db442963e3eadecb55 Signed-off-by: Mooli Tayer mtayer@redhat.com Reviewed-on: http://gerrit.ovirt.org/31293 Reviewed-by: Dima Kuznetsov dkuznets@redhat.com Reviewed-by: Yaniv Bronhaim ybronhei@redhat.com Reviewed-by: Dan Kenigsberg danken@redhat.com --- M lib/vdsm/tool/__init__.py M lib/vdsm/tool/configurator.py M lib/vdsm/tool/configurators/libvirt.py M lib/vdsm/tool/configurators/sanlock.py 4 files changed, 20 insertions(+), 7 deletions(-)
Approvals: Yaniv Bronhaim: Looks good to me, but someone else must approve mooli tayer: Verified Dima Kuznetsov: Looks good to me, but someone else must approve Dan Kenigsberg: Looks good to me, approved
oVirt Jenkins CI Server has posted comments on this change.
Change subject: vdsm-tool: changing root checking in configurator. ......................................................................
Patch Set 7:
Build Failed
http://jenkins.ovirt.org/job/vdsm_master_verify-error-codes_merged/5768/ : SUCCESS
http://jenkins.ovirt.org/job/vdsm_master_create-rpms_merged_test_debug/133/ : FAILURE
http://jenkins.ovirt.org/job/vdsm_master_unit-tests_merged/3927/ : FAILURE
http://jenkins.ovirt.org/job/vdsm_master_create-rpms_merged/1792/ : FAILURE
vdsm-patches@lists.fedorahosted.org