
from oslo_privsep import capabilities as c
from oslo_privsep import priv_context

# It is expected that most (if not all) os-brick operations can be
# executed with these privileges.
default = priv_context.PrivContext(
    __name__,
    cfg_section='privsep_osbrick',
    pypath=__name__ + '.default',
    capabilities=[c.CAP_SYS_ADMIN],
)


import os

from oslo_privsep import capabilities as c
from oslo_privsep import priv_context


capabilities = [c.CAP_SYS_ADMIN]

# On virtual environments libraries are not owned by the Daemon user (root), so
# the Daemon needs the capability to bypass file read permission checks in
# order to dynamically load the code to run.
if os.environ.get('VIRTUAL_ENV'):
    capabilities.append(c.CAP_DAC_READ_SEARCH)

# It is expected that most (if not all) os-brick operations can be
# executed with these privileges.
default = priv_context.PrivContext(
    __name__,
    cfg_section='privsep_osbrick',
    pypath=__name__ + '.default',
    capabilities=capabilities,
)

Fix os-brick in virtual environments
Fix os-brick in virtual environments

When running os-brick in a virtual environment created by a non root
user, we get the following error:

  ModuleNotFoundError: No module named 'os_brick.privileged.rootwrap'

This happens because the privsep daemon drops all the privileged except
those defined in the context, and our current context doesn't bypass
file read permission checks, so the Daemon cannot read the file with the
code it was asked to run, because it belongs to a different user.

This patch adds the CAP_DAC_READ_SEARCH capability to our privsep
context so we can load the libraries, but only when we are running on a
virtual environment to follow the principle of least privilege.

This bug doesn't affect system-wide installations because the files
installed under /sys/python*/site-packages belong to the Daemon user
(root), so no special capabilities are necessary.

Change-Id: Ib191c075ad1250822f6ac842f39214af8f3a02f0
Close-Bug: #1884059

+ 
+ import os
  
  from oslo_privsep import capabilities as c
  from oslo_privsep import priv_context
+ 
+ 
+ capabilities = [c.CAP_SYS_ADMIN]
+ 
+ # On virtual environments libraries are not owned by the Daemon user (root), so
+ # the Daemon needs the capability to bypass file read permission checks in
+ # order to dynamically load the code to run.
+ if os.environ.get('VIRTUAL_ENV'):
+     capabilities.append(c.CAP_DAC_READ_SEARCH)
  
  # It is expected that most (if not all) os-brick operations can be
  # executed with these privileges.
  default = priv_context.PrivContext(
      __name__,
      cfg_section='privsep_osbrick',
      pypath=__name__ + '.default',
-     capabilities=[c.CAP_SYS_ADMIN],
+     capabilities=capabilities,
  )
  
Fix os-brick in virtual environments
## Code Before:

from oslo_privsep import capabilities as c
from oslo_privsep import priv_context

# It is expected that most (if not all) os-brick operations can be
# executed with these privileges.
default = priv_context.PrivContext(
    __name__,
    cfg_section='privsep_osbrick',
    pypath=__name__ + '.default',
    capabilities=[c.CAP_SYS_ADMIN],
)

## Instruction:
Fix os-brick in virtual environments
## Code After:

import os

from oslo_privsep import capabilities as c
from oslo_privsep import priv_context


capabilities = [c.CAP_SYS_ADMIN]

# On virtual environments libraries are not owned by the Daemon user (root), so
# the Daemon needs the capability to bypass file read permission checks in
# order to dynamically load the code to run.
if os.environ.get('VIRTUAL_ENV'):
    capabilities.append(c.CAP_DAC_READ_SEARCH)

# It is expected that most (if not all) os-brick operations can be
# executed with these privileges.
default = priv_context.PrivContext(
    __name__,
    cfg_section='privsep_osbrick',
    pypath=__name__ + '.default',
    capabilities=capabilities,
)
