diff options
| author | Jenkins <jenkins@review.openstack.org> | 2015-11-09 18:02:50 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2015-11-09 18:02:50 +0000 |
| commit | cb578df3b0eb442bed2b6d938eb28848104fbd44 (patch) | |
| tree | d9d2745e4e24602e69d103faaf95fac02ef0d6e3 /docker/base/sudoers | |
| parent | 817b31231c29d689a91137d10d8d1a5c076f0657 (diff) | |
| parent | 6cf5928ff1ee2f9d21662d74057f3a8331ddedfb (diff) | |
| download | kolla-cb578df3b0eb442bed2b6d938eb28848104fbd44.tar.gz kolla-cb578df3b0eb442bed2b6d938eb28848104fbd44.zip | |
Merge "Base image changes for drop-root"
Diffstat (limited to 'docker/base/sudoers')
| -rw-r--r-- | docker/base/sudoers | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/docker/base/sudoers b/docker/base/sudoers new file mode 100644 index 000000000..0205b920f --- /dev/null +++ b/docker/base/sudoers @@ -0,0 +1,16 @@ +# The idea here is a container service adds their UID to the kolla group +# via usermod -a -G kolla <uid>. Then the kolla_start may run +# kolla_set_configs via sudo as the root user which is necessary to protect +# the immutability of the container + +# anyone in the kolla group may sudo -E (set the environment) +Defaults: %kolla setenv + +# root may run any commands via sudo as the network seervice user. This is +# neededfor database migrations of existing services which have not been +# converted to run as a non-root user, but instead do that via sudo -E glance +root ALL=(ALL) ALL + +# anyone in the kolla group may run /usr/local/bin/kolla_set_configs as the +# root user via sudo without password confirmation +%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_set_configs |