1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
=============
nova-rootwrap
=============
.. program:: nova-rootwrap
Synopsis
========
::
nova-rootwrap CONFIG_FILE COMMAND
Description
===========
:program:`nova-rootwrap` is an application that filters which commands nova is
allowed to run as another user.
To use this, you should set the following in ``nova.conf``::
rootwrap_config=/etc/nova/rootwrap.conf
You also need to let the nova user run :program:`nova-rootwrap` as root in
``sudoers``::
nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap /etc/nova/rootwrap.conf *
To make allowed commands node-specific, your packaging should only install
``{compute,network}.filters`` respectively on compute and network nodes, i.e.
:program:`nova-api-wsgi` nodes should not have any of those files installed.
.. note::
:program:`nova-rootwrap` is being slowly deprecated and replaced by
``oslo.privsep``, and will eventually be removed.
Files
=====
* ``/etc/nova/nova.conf``
* ``/etc/nova/rootwrap.conf``
* ``/etc/nova/rootwrap.d/``
See Also
========
:doc:`nova-compute(1) <nova-compute>`
Bugs
====
* Nova bugs are managed at `Launchpad <https://bugs.launchpad.net/nova>`__
|
