Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Doug Hellmann
Excerpts from Thierry Carrez's message of 2015-09-10 19:35:21 +0200: > Doug Hellmann wrote: > > Excerpts from Thierry Carrez's message of 2015-09-10 14:23:34 +0200: > >> My quick 2cents on this. Rootwrap was designed as a generic solution to > >> wrap privileged calls. That's why filter files are p

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Doug Hellmann
Excerpts from Sean Dague's message of 2015-09-10 14:11:20 -0400: > On 09/10/2015 01:05 PM, Doug Hellmann wrote: > > Excerpts from Thierry Carrez's message of 2015-09-10 14:23:34 +0200: > >> Sean Dague wrote: > >>> Right now, they are all a bunch of files, they can be anywhere. And then > >>> you ha

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Sean Dague
On 09/10/2015 01:05 PM, Doug Hellmann wrote: > Excerpts from Thierry Carrez's message of 2015-09-10 14:23:34 +0200: >> Sean Dague wrote: >>> Right now, they are all a bunch of files, they can be anywhere. And then >>> you have other files that have to reference these files by path, which >>> can be

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Joshua Harlow
Just out of curiosity, not 100% related to this thread, but other applications also bundle configuration files (for example heat templates @ https://github.com/openstack/magnum/tree/master/magnum/templates) Should there be some guidelines on how these config files are packaged and distributed

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Thierry Carrez
Doug Hellmann wrote: > Excerpts from Thierry Carrez's message of 2015-09-10 14:23:34 +0200: >> My quick 2cents on this. Rootwrap was designed as a generic solution to >> wrap privileged calls. That's why filter files are part of its >> "configuration". The problem is, OpenStack needs a pretty preci

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Thierry Carrez
Sean Dague wrote: > On 09/10/2015 08:23 AM, Thierry Carrez wrote: >> Now another problem you're describing is that there is no single place >> where those filters end up, depending on the way the projects (or libs) >> are packaged and installed. And it's up to the distros to "fix" the >> filters_pa

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Doug Hellmann
Excerpts from Thierry Carrez's message of 2015-09-10 14:23:34 +0200: > Sean Dague wrote: > > Right now, they are all a bunch of files, they can be anywhere. And then > > you have other files that have to reference these files by path, which > > can be anywhere. We could just punt in that part and s

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Sean Dague
On 09/10/2015 08:23 AM, Thierry Carrez wrote: > Sean Dague wrote: >> Right now, they are all a bunch of files, they can be anywhere. And then >> you have other files that have to reference these files by path, which >> can be anywhere. We could just punt in that part and say "punt! every >> install

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Thierry Carrez
Sean Dague wrote: > Right now, they are all a bunch of files, they can be anywhere. And then > you have other files that have to reference these files by path, which > can be anywhere. We could just punt in that part and say "punt! every > installer and configuration management install needs to sol

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-10 Thread Sean Dague
On 09/09/2015 07:16 PM, Doug Hellmann wrote: > Excerpts from Matt Riedemann's message of 2015-09-09 13:45:29 -0500: >> >> On 9/9/2015 1:04 PM, Doug Hellmann wrote: >>> Excerpts from Sean Dague's message of 2015-09-09 13:36:37 -0400: >> The problem with the static file paths in rootwrap.conf is tha

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Doug Hellmann
Excerpts from Matt Riedemann's message of 2015-09-09 13:45:29 -0500: > > On 9/9/2015 1:04 PM, Doug Hellmann wrote: > > Excerpts from Sean Dague's message of 2015-09-09 13:36:37 -0400: > >> We've got a new pattern emerging where some of the key functionality in > >> services is moving into librarie

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Sean McGinnis
On Wed, Sep 09, 2015 at 03:33:36PM -0400, Sean Dague wrote: > On 09/09/2015 02:55 PM, Robert Collins wrote: > > On 10 September 2015 at 06:45, Matt Riedemann > > wrote: > >> > > So, I realise thats a bit sucky. My suggestion would be to just take > > the tactical approach of syncing things into ea

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Robert Collins
On 10 September 2015 at 07:33, Sean Dague wrote: > On 09/09/2015 02:55 PM, Robert Collins wrote: >> On 10 September 2015 at 06:45, Matt Riedemann >> wrote: >>> >> >>> The problem with the static file paths in rootwrap.conf is that we don't >>> know where those other library filter files are going

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Sean McGinnis
> Sent: Wednesday, September 09, 2015 at 2:33 PM > From: "Sean Dague" > To: "OpenStack Development Mailing List (not for usage questions)" > > Subject: Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC > > On 09/09/2015 02:55 PM, Robert Coll

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Sean Dague
On 09/09/2015 02:55 PM, Robert Collins wrote: > On 10 September 2015 at 06:45, Matt Riedemann > wrote: >> > >> The problem with the static file paths in rootwrap.conf is that we don't >> know where those other library filter files are going to end up on the >> system when the library is installed

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Robert Collins
On 10 September 2015 at 06:45, Matt Riedemann wrote: > > The problem with the static file paths in rootwrap.conf is that we don't > know where those other library filter files are going to end up on the > system when the library is installed. We could hard-code nova's > rootwrap.conf filter_path

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Matt Riedemann
On 9/9/2015 1:04 PM, Doug Hellmann wrote: Excerpts from Sean Dague's message of 2015-09-09 13:36:37 -0400: We've got a new pattern emerging where some of the key functionality in services is moving into libraries that can be called from different services. A good instance of this is os-brick,

Re: [openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Doug Hellmann
Excerpts from Sean Dague's message of 2015-09-09 13:36:37 -0400: > We've got a new pattern emerging where some of the key functionality in > services is moving into libraries that can be called from different > services. A good instance of this is os-brick, which has the setup / > config functional

[openstack-dev] [rootwrap] rootwrap and libraries - RFC

2015-09-09 Thread Sean Dague
We've got a new pattern emerging where some of the key functionality in services is moving into libraries that can be called from different services. A good instance of this is os-brick, which has the setup / config functionality for devices that sometimes need to be called by cinder and sometimes