Reworking paths to allow non-root usage and support multiple instances. Fixes T483
ClosedPublic

Authored by tflink on May 26 2015, 9:13 PM.

Details

Summary

This is the first step in what will be a rather large change to testCloud.
The code is still a bit messy and atomic support doesn't work with this but
I wanted to keep these changes as bite-sized as possible - the missing funcationlity
will be added back later and code will get cleaner as the entire refactor
progresses

Test Plan

unit tests pass, vms are still booted from cli interface

Diff Detail

Repository
rTCLOUD testcloud
Branch
feature/T483-noroot-permissions
Lint
No Linters Available
Unit
No Unit Test Coverage
tflink retitled this revision from to Reworking paths to allow non-root usage and support multiple instances. Fixes T483.May 26 2015, 9:13 PM
tflink updated this object.
tflink edited the test plan for this revision. (Show Details)
tflink added a reviewer: roshi.
tflink updated this revision to Diff 1006.May 27 2015, 8:54 PM
  • check for existing file before re-downloading image
tflink added a comment.Jun 1 2015, 5:08 PM

After talking with @roshi about this - it turns out that I was relying on some polkit stuff that is configured/setup by default with most DEs but doesn't always work with custom setups and doesn't work with headless boxes.

To fix this, create a /etc/polkit-1/localauthority/50-local.d/50-nonrootlivirt.pkla file with the following contents

[nonroot libvirt system connection]
Identity=unix-group:testcloud
Action=org.libvirt.unix.manage
ResultActive=yes
ResultInactive=yes
ResultAny=yes

Then restart polkit (systemctl restart polkit) and make sure that your user is in the testcloud unix group (or subsitute any other group name as long as it matches the pkla file - this is only an example).

If the following command completes with retcode 0, this testcloud patch should work as a non-root user.

pkcheck --action-id org.libvirt.unix.manage --allow-user-interaction --process $BASHPID
roshi requested changes to this revision.Jun 1 2015, 6:26 PM

Just update the docs with the dirs, and I think it's good to go.

README.rst
23

I think the dirs it needs are /var/lib/testCloud/{instances,cache} - it won't automagically make them.

This revision now requires changes to proceed.Jun 1 2015, 6:26 PM
tflink added a comment.Jun 1 2015, 6:43 PM
In D376#6904, @roshi wrote:

Just update the docs with the dirs, and I think it's good to go.

Yeah, makes sense. We may want to make that more automagical at some point but it's not that way now. I'll fix the docs quick, including the polkit stuff.

tflink updated this revision to Diff 1011.Jun 1 2015, 6:51 PM
  • updating docs to describe the currently required setup
roshi accepted this revision.Jun 1 2015, 6:52 PM

Looks good to me.

This revision is now accepted and ready to land.Jun 1 2015, 6:52 PM
tflink added a comment.Jun 1 2015, 7:06 PM

We really need to nail down this process better - doing both phab reviews and github PRs seems a little excessive to me.

Submitted PR: https://github.com/Rorosha/testCloud/pull/11

tflink closed this revision.Jun 1 2015, 7:08 PM

PR was merged into Rorosha/testCloud - closing revision

kparal added a subscriber: kparal.Jun 3 2015, 12:17 PM
In D376#6899, @tflink wrote:

After talking with @roshi about this - it turns out that I was relying on some polkit stuff that is configured/setup by default with most DEs but doesn't always work with custom setups and doesn't work with headless boxes.

To fix this, create a /etc/polkit-1/localauthority/50-local.d/50-nonrootlivirt.pkla file with the following contents

[nonroot libvirt system connection]
Identity=unix-group:testcloud
Action=org.libvirt.unix.manage
ResultActive=yes
ResultInactive=yes
ResultAny=yes

Then restart polkit (systemctl restart polkit) and make sure that your user is in the testcloud unix group (or subsitute any other group name as long as it matches the pkla file - this is only an example).

@tflink This is interesting, what system have you tried this with? Because since Fedora 18 the old .pkla ini files should not be supported and javascript .rules files should be used instead. Not sure if there's some compatibility mode, but I'm quite sure I needed to adjust my own rules to the new syntax.

tflink added a comment.Jun 3 2015, 1:29 PM
In D376#6959, @kparal wrote:

@tflink This is interesting, what system have you tried this with? Because since Fedora 18 the old .pkla ini files should not be supported and javascript .rules files should be used instead. Not sure if there's some compatibility mode, but I'm quite sure I needed to adjust my own rules to the new syntax.

I tried the javascript syntax and couldn't get it to work on systems that didn't have a polkit agent on them. The only way I was able to get it to work on headless or non-standard-DE systems was to use the ini-style pkla file

tflink added a comment.Jun 3 2015, 4:49 PM

Reading through the docs, the only solution I see that doesn't involve localauthority (the old ini style polkit conf) is to write a custom polkit agent and make sure it's started on headless systems.

But given the scarcity of docs about polkit and how to short-circuit the authentication bits (or have ssh key auth be enough) for non-human users, I could easily be wrong.