diff --git a/files/sudo/nova b/files/sudo/nova index 3843416..2ce1aac 100644 --- a/files/sudo/nova +++ b/files/sudo/nova @@ -1 +1,47 @@ -socat +Cmnd_Alias NOVACMDS = /bin/chmod /var/lib/nova/tmp/*/root/.ssh, \ + /bin/chown /var/lib/nova/tmp/*/root/.ssh, \ + /bin/chown, \ + /bin/chmod, \ + /bin/dd, \ + /sbin/ifconfig, \ + /sbin/ip, \ + /sbin/route, \ + /sbin/iptables, \ + /sbin/iptables-save, \ + /sbin/iptables-restore, \ + /sbin/ip6tables-save, \ + /sbin/ip6tables-restore, \ + /sbin/kpartx, \ + /sbin/losetup, \ + /sbin/lvcreate, \ + /sbin/lvdisplay, \ + /sbin/lvremove, \ + /bin/mkdir, \ + /bin/mount, \ + /sbin/pvcreate, \ + /usr/bin/tee, \ + /sbin/tune2fs, \ + /bin/umount, \ + /sbin/vgcreate, \ + /usr/bin/virsh, \ + /usr/bin/qemu-nbd, \ + /usr/sbin/brctl, \ + /sbin/brctl, \ + /usr/sbin/radvd, \ + /usr/sbin/vblade-persist, \ + /sbin/pvcreate, \ + /sbin/aoe-discover, \ + /sbin/vgcreate, \ + /bin/aoe-stat, \ + /bin/kill, \ + /sbin/vconfig, \ + /usr/sbin/ietadm, \ + /sbin/vgs, \ + /sbin/iscsiadm, \ + /usr/bin/socat, \ + /sbin/parted, \ + /usr/sbin/dnsmasq, \ + /usr/bin/arping + +%USER% ALL = (root) NOPASSWD: SETENV: NOVACMDS + diff --git a/stack.sh b/stack.sh index 14bcfb2..5366ae3 100755 --- a/stack.sh +++ b/stack.sh @@ -116,6 +116,14 @@ if [[ $EUID -eq 0 ]]; then exec su -c "set -e; cd $STACK_DIR; bash stack.sh" stack fi exit 1 +else + # Our user needs passwordless priviledges for certain commands which nova + # uses internally. + # Natty uec images sudoers does not have a '#includedir'. add one. + sudo grep -q "^#includedir.*/etc/nsudoers.d" /etc/sudoers || + echo "#includedir /etc/nsudoers.d" | sudo tee -a /etc/sudoers + sudo cp $FILES/sudo/nova /etc/sudoers.d/stack_sh_nova + sudo sed -e "s,%USER%,$USER,g" -i /etc/sudoers.d/stack_sh_nova fi # Set the destination directories for openstack projects @@ -364,8 +372,6 @@ cd $DASH_DIR/openstack-dashboard; sudo python setup.py develop # it since we are going to run the services in screen for simple cp $FILES/screenrc ~/.screenrc -## TODO: update current user to allow sudo for all commands in files/sudo/* - # Rabbit # ---------