On Fri, Jul 26, 2013 at 7:43 AM, Thierry Carrez <[email protected]> wrote:
> I would rather support solution 3: create a single, separate executable > that does those 20 things that need to be done (can be a shell script > with some logic in it), and have rootwrap call that *once*. That way you > increase speed by 20 times without dumping the security model. I worry about this script getting out of date compared with the nova binary. What about an abstraction class around shell commands where you specify what commands you want to run, then it exports a generated shell script and executes it with root-wrap? We'd of course have to pay attention to using secure temporary files for the generated scripts, but we could ask for an OSSG bench audit of those bits. Michael -- Rackspace Australia _______________________________________________ OpenStack-dev mailing list [email protected] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
