Reviewed: https://review.opendev.org/c/openstack/neutron/+/834071 Committed: https://opendev.org/openstack/neutron/commit/0529ccdf71dcd093a80180097eeaa5d7cb5e15fb Submitter: "Zuul (22348)" Branch: master
commit 0529ccdf71dcd093a80180097eeaa5d7cb5e15fb Author: Jakub Libosvar <[email protected]> Date: Wed Mar 16 16:40:21 2022 -0400 ovn migration: Don't use executables in /tmp/ It's a common practice to have /tmp/ mounted separately with noexec option. This effectively means no scripts can be executed from the filesystem mounted to /tmp. This patch explicitly calls sh binary to execute scripts from /tmp and removes the executable flag from the scripts. Closes-Bug: #1965183 Change-Id: I2f9cd67979a8a75848fcdd7a8c3bb56dd3590473 Signed-off-by: Jakub Libosvar <[email protected]> ** Changed in: neutron Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1965183 Title: ovn migration executes scripts from /tmp directory Status in neutron: Fix Released Bug description: Description of problem: The /tmp are often mounted with noexec option for security reasons. The migration roles rely that scripts in /tmp/ can be executed. Version-Release number of selected component (if applicable): 16.1 How reproducible: Always Steps to Reproduce: 1. Have /tmp mounted with noexec option 2. Run migration from ovs to ovn 3. Actual results: fatal: [tpa-vim-b-computecl-0]: FAILED! => { "changed": true, "cmd": "/tmp/clone-br-int.sh", "delta": "0:00:00.001773", "end": "2022-03-16 18:51:30.332449", "invocation": { "module_args": { "_raw_params": "/tmp/clone-br-int.sh", "_uses_shell": true, "argv": null, "chdir": null, "creates": null, "executable": null, "removes": null, "stdin": null, "stdin_add_newline": true, "strip_empty_ends": true, "warn": true } }, "msg": "non-zero return code", "rc": 126, "start": "2022-03-16 18:51:30.330676", "stderr": "/bin/sh: /tmp/clone-br-int.sh: Permission denied", "stderr_lines": [ "/bin/sh: /tmp/clone-br-int.sh: Permission denied" ], "stdout": "", "stdout_lines": [] } To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1965183/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : [email protected] Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
