From 3c87de7c12c30d380e12b19dc0473d1e3bcfd233 Mon Sep 17 00:00:00 2001 From: Thierry Carrez Date: Mon, 21 Nov 2011 16:28:02 +0100 Subject: A more secure root-wrapper alternative Alternative to using a sudoers file to limit which commands can be run as root in Nova. This one makes use of command filters defined in Nova code itself, which can be customized to deeply inspect command arguments before allowing a command to be executed. This change puts the infrastructure in place, together with command filters that replicate the level of filtering provided by a sudoers file (no deep argument inspection yet). An example of an advanced filter (RegExpFilter) is also provided. This new root wrapper is not active by default (root_helper still defaults to "sudo"). Implements blueprint nova-rootwrap. Change-Id: I7ad723b55e9446758876f21b4fbb09374a910425 --- setup.py | 1 + 1 file changed, 1 insertion(+) (limited to 'setup.py') diff --git a/setup.py b/setup.py index 859c20ebc..f44acfcbf 100644 --- a/setup.py +++ b/setup.py @@ -104,6 +104,7 @@ setup(name='nova', 'bin/nova-manage', 'bin/nova-network', 'bin/nova-objectstore', + 'bin/nova-rootwrap', 'bin/nova-scheduler', 'bin/nova-spoolsentry', 'bin/stack', -- cgit