diff options
| author | Jenkins <jenkins@review.openstack.org> | 2017-04-04 06:34:43 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2017-04-04 06:34:43 +0000 |
| commit | 99e2b96764ada443b06db69918a5d30abe2527d3 (patch) | |
| tree | 9505a7a7862d265ce452c238bfce1af5805387b1 | |
| parent | 9726d2c5af25cc688cec1efe3705b3abfbbfa805 (diff) | |
| parent | 1c3336c8c9c1a77964041730973b4839c9a4c441 (diff) | |
| download | kolla-99e2b96764ada443b06db69918a5d30abe2527d3.tar.gz kolla-99e2b96764ada443b06db69918a5d30abe2527d3.zip | |
Merge "Use separate sudoers for ironic conductor modprobe"
| -rw-r--r-- | docker/ironic/ironic-base/Dockerfile.j2 | 4 | ||||
| -rw-r--r-- | docker/ironic/ironic-base/ironic_sudoers | 2 | ||||
| -rw-r--r-- | docker/ironic/ironic-conductor/Dockerfile.j2 | 4 | ||||
| -rw-r--r-- | docker/ironic/ironic-conductor/iscsi_tcp_sudoers | 1 |
4 files changed, 7 insertions, 4 deletions
diff --git a/docker/ironic/ironic-base/Dockerfile.j2 b/docker/ironic/ironic-base/Dockerfile.j2 index ddde46b80..e192aba48 100644 --- a/docker/ironic/ironic-base/Dockerfile.j2 +++ b/docker/ironic/ironic-base/Dockerfile.j2 @@ -31,12 +31,12 @@ RUN ln -s ironic-base-source/* ironic \ && chown -R ironic: /etc/ironic \ && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/ironic/rootwrap.conf -{% endif %} - ADD ironic_sudoers /etc/sudoers.d/kolla_ironic_sudoers RUN chmod 750 /etc/sudoers.d \ && chmod 440 /etc/sudoers.d/kolla_ironic_sudoers +{% endif %} + COPY extend_start.sh /usr/local/bin/kolla_extend_start RUN touch /usr/local/bin/kolla_ironic_extend_start \ diff --git a/docker/ironic/ironic-base/ironic_sudoers b/docker/ironic/ironic-base/ironic_sudoers index 573aa2194..3e7c843f3 100644 --- a/docker/ironic/ironic-base/ironic_sudoers +++ b/docker/ironic/ironic-base/ironic_sudoers @@ -1 +1 @@ -ironic ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/ironic-rootwrap /etc/ironic/rootwrap.conf *, /usr/sbin/modprobe iscsi_tcp, /sbin/modprobe iscsi_tcp +ironic ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/ironic-rootwrap /etc/ironic/rootwrap.conf * diff --git a/docker/ironic/ironic-conductor/Dockerfile.j2 b/docker/ironic/ironic-conductor/Dockerfile.j2 index 0e35fc417..92b615c54 100644 --- a/docker/ironic/ironic-conductor/Dockerfile.j2 +++ b/docker/ironic/ironic-conductor/Dockerfile.j2 @@ -90,7 +90,9 @@ RUN {{ macros.install_pip(ironic_conductor_pip_packages | customizable("pip_pack {{ macros.install_packages(ironic_conductor_packages | customizable("packages")) }} COPY extend_start.sh /usr/local/bin/kolla_ironic_extend_start -RUN chmod 755 /usr/local/bin/kolla_ironic_extend_start +COPY iscsi_tcp_sudoers /etc/sudoers.d/kolla_iscsi_tcp_sudoers +RUN chmod 755 /usr/local/bin/kolla_ironic_extend_start \ + && chmod 440 /etc/sudoers.d/kolla_iscsi_tcp_sudoers {% block ironic_conductor_footer %}{% endblock %} {% block footer %}{% endblock %} diff --git a/docker/ironic/ironic-conductor/iscsi_tcp_sudoers b/docker/ironic/ironic-conductor/iscsi_tcp_sudoers new file mode 100644 index 000000000..75f5e3411 --- /dev/null +++ b/docker/ironic/ironic-conductor/iscsi_tcp_sudoers @@ -0,0 +1 @@ +ironic ALL = (root) NOPASSWD: /usr/sbin/modprobe iscsi_tcp, /sbin/modprobe iscsi_tcp |