a40f9cb91f
Since we are python3 only for openstack we create a single python3 virtualenv to install all the packages into. This gives us the benefits of installing into a virtualenv while still ensuring coinstallability. This is a major change and will likely break many things. There are several reasons for this. The change that started this effort was pip stopped uninstalling packages which used distutils to generate their package installation. Many distro packages do this which meant that pip installed packages and distro packages could not coexist in the global install space. More recently git has made pip installing repos as root more difficult due to file ownership concerns. Currently the switch to the global venv is optional, but if we go down this path we should very quickly remove the old global installation method as it has only caused us problems. Major hurdles we have to get over are convincing rootwrap to trust binaries in the virtualenvs (so you'll notice we update rootwrap configs). Some distros still have issues, keep them using the old setup for now. Depends-On: https://review.opendev.org/c/openstack/grenade/+/880266 Co-Authored-By: Dr. Jens Harbott <frickler@offenerstapel.de> Change-Id: If9bc7ba45522189d03f19b86cb681bb150ee2f25
95 lines
3.2 KiB
Bash
95 lines
3.2 KiB
Bash
#!/bin/bash
|
|
#
|
|
# **inc/rootwrap** - Rootwrap functions
|
|
#
|
|
# Handle rootwrap's foibles
|
|
|
|
# Uses: ``STACK_USER``
|
|
# Defines: ``SUDO_SECURE_PATH_FILE``
|
|
|
|
# Save trace setting
|
|
INC_ROOT_TRACE=$(set +o | grep xtrace)
|
|
set +o xtrace
|
|
|
|
# Accumulate all additions to sudo's ``secure_path`` in one file read last
|
|
# so they all work in a venv configuration
|
|
SUDO_SECURE_PATH_FILE=${SUDO_SECURE_PATH_FILE:-/etc/sudoers.d/zz-secure-path}
|
|
|
|
# Add a directory to the common sudo ``secure_path``
|
|
# add_sudo_secure_path dir
|
|
function add_sudo_secure_path {
|
|
local dir=$1
|
|
local line
|
|
|
|
# This is pretty simplistic for now - assume only the first line is used
|
|
if [[ -r $SUDO_SECURE_PATH_FILE ]]; then
|
|
line=$(head -1 $SUDO_SECURE_PATH_FILE)
|
|
else
|
|
line="Defaults:$STACK_USER secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin"
|
|
fi
|
|
|
|
# Only add ``dir`` if it is not already present
|
|
if [[ ! $line =~ $dir ]]; then
|
|
echo "${line}:$dir" | sudo tee $SUDO_SECURE_PATH_FILE
|
|
sudo chmod 400 $SUDO_SECURE_PATH_FILE
|
|
sudo chown root:root $SUDO_SECURE_PATH_FILE
|
|
fi
|
|
}
|
|
|
|
# Configure rootwrap
|
|
# Make a load of assumptions otherwise we'll have 6 arguments
|
|
# configure_rootwrap project
|
|
function configure_rootwrap {
|
|
local project=$1
|
|
local project_uc
|
|
project_uc=$(echo $1|tr a-z A-Z)
|
|
local bin_dir="${project_uc}_BIN_DIR"
|
|
bin_dir="${!bin_dir}"
|
|
local project_dir="${project_uc}_DIR"
|
|
project_dir="${!project_dir}"
|
|
|
|
local rootwrap_conf_src_dir="${project_dir}/etc/${project}"
|
|
local rootwrap_bin="${bin_dir}/${project}-rootwrap"
|
|
|
|
# Start fresh with rootwrap filters
|
|
sudo rm -rf /etc/${project}/rootwrap.d
|
|
sudo install -d -o root -g root -m 755 /etc/${project}/rootwrap.d
|
|
sudo install -o root -g root -m 644 $rootwrap_conf_src_dir/rootwrap.d/*.filters /etc/${project}/rootwrap.d
|
|
|
|
# Set up rootwrap.conf, pointing to /etc/*/rootwrap.d
|
|
sudo install -o root -g root -m 644 $rootwrap_conf_src_dir/rootwrap.conf /etc/${project}/rootwrap.conf
|
|
sudo sed -e "s:^filters_path=.*$:filters_path=/etc/${project}/rootwrap.d:" -i /etc/${project}/rootwrap.conf
|
|
|
|
# Rely on $PATH set by devstack to determine what is safe to execute
|
|
# by rootwrap rather than use explicit whitelist of paths in
|
|
# rootwrap.conf
|
|
sudo sed -e 's/^exec_dirs=.*/#&/' -i /etc/${project}/rootwrap.conf
|
|
|
|
# Set up the rootwrap sudoers
|
|
local tempfile
|
|
tempfile=$(mktemp)
|
|
# Specify rootwrap.conf as first parameter to rootwrap
|
|
rootwrap_sudo_cmd="${rootwrap_bin} /etc/${project}/rootwrap.conf *"
|
|
echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudo_cmd" >$tempfile
|
|
if [ -f ${bin_dir}/${project}-rootwrap-daemon ]; then
|
|
# rootwrap daemon does not need any parameters
|
|
rootwrap_sudo_cmd="${rootwrap_bin}-daemon /etc/${project}/rootwrap.conf"
|
|
echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudo_cmd" >>$tempfile
|
|
fi
|
|
chmod 0440 $tempfile
|
|
sudo chown root:root $tempfile
|
|
sudo mv $tempfile /etc/sudoers.d/${project}-rootwrap
|
|
|
|
# Add bin dir to sudo's secure_path because rootwrap is being called
|
|
# without a path because BROKEN.
|
|
add_sudo_secure_path $(dirname $rootwrap_bin)
|
|
}
|
|
|
|
|
|
# Restore xtrace
|
|
$INC_ROOT_TRACE
|
|
|
|
# Local variables:
|
|
# mode: shell-script
|
|
# End:
|