table of contents
other versions
- buster 2:18.1.0-6
- testing 2:22.0.1-1
- unstable 2:22.0.1-2
- experimental 2:23.0.2-1
NOVA-ROOTWRAP(1) | nova | NOVA-ROOTWRAP(1) |
NAME¶
nova-rootwrap - Cloud controller fabricROOT WRAPPER FOR NOVA¶
- Author
- openstack@lists.openstack.org
- Copyright
- OpenStack Foundation
- Manual section
- 1
- Manual group
- cloud computing
Synopsis¶
nova-rootwrap [options]
Description¶
nova-rootwrap is an application that filters which commands nova is allowed to run as another user.To use this, you should set the following in nova.conf:
rootwrap_config=/etc/nova/rootwrap.conf
You also need to let the nova user run nova-rootwrap as root in sudoers:
nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap /etc/nova/rootwrap.conf *
To make allowed commands node-specific, your packaging should only install {compute,network}.filters respectively on compute and network nodes, i.e. nova-api nodes should not have any of those files installed.
NOTE:
nova-rootwrap is being slowly deprecated and
replaced by oslo.privsep, and will eventually be removed.
Options¶
General optionsFiles¶
- /etc/nova/nova.conf
- /etc/nova/rootwrap.conf
- /etc/nova/rootwrap.d/
See Also¶
- •
- OpenStack Nova
Bugs¶
- •
- Nova bugs are managed at Launchpad
AUTHOR¶
OpenStackCOPYRIGHT¶
2010-present, OpenStack FoundationMay 29, 2019 | 18.1.0 |