diff options
| author | Jenkins <jenkins@review.openstack.org> | 2012-07-24 16:21:41 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2012-07-24 16:21:41 +0000 |
| commit | 013ab2fdfc2c8a0c74ecf3c2287fb6a36d8b6728 (patch) | |
| tree | ba25ac55a9c5178c125fd1d7cf90c397b99371b1 | |
| parent | 4c9c0d74d4de955f3ab7d0ceb2e6f0621710a6a3 (diff) | |
| parent | 6c888001f15fba44aaaaaf367757dd81b8512f65 (diff) | |
Merge "Provide rootwrap filters for nova-api-metadata"
| -rw-r--r-- | etc/nova/rootwrap.d/api-metadata.filters | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/etc/nova/rootwrap.d/api-metadata.filters b/etc/nova/rootwrap.d/api-metadata.filters new file mode 100644 index 000000000..ef454cbff --- /dev/null +++ b/etc/nova/rootwrap.d/api-metadata.filters @@ -0,0 +1,17 @@ +# nova-rootwrap command filters for api-metadata nodes +# This is needed on nova-api hosts running with "metadata" in enabled_apis +# or when running nova-api-metadata +# This file should be owned by (and only-writeable by) the root user + +[Filters] +# nova/network/linux_net.py: 'ip[6]tables-save' % (cmd, '-t', ... +iptables-save: CommandFilter, /sbin/iptables-save, root +iptables-save_usr: CommandFilter, /usr/sbin/iptables-save, root +ip6tables-save: CommandFilter, /sbin/ip6tables-save, root +ip6tables-save_usr: CommandFilter, /usr/sbin/ip6tables-save, root + +# nova/network/linux_net.py: 'ip[6]tables-restore' % (cmd,) +iptables-restore: CommandFilter, /sbin/iptables-restore, root +iptables-restore_usr: CommandFilter, /usr/sbin/iptables-restore, root +ip6tables-restore: CommandFilter, /sbin/ip6tables-restore, root +ip6tables-restore_usr: CommandFilter, /usr/sbin/ip6tables-restore, root |