rootwrap filter for ip netns exec

[dan wendlandt]

There is a security hole when using rootwrap with Quantum, since rootwrap allows the use of "ip netns exec" to run commands in a particular namespace. This could be used to subvert rootwrap and run arbitrary commands.

The solution is to create a special filter type that only allows certain allowed required commands to be executed within a namespace.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/12388

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/12388
Committed: http://github.com/openstack/quantum/commit/28df8f6d8f2fddf5fb5751eb5100d40a9b4745fa
Submitter: Jenkins
Branch: master

commit 28df8f6d8f2fddf5fb5751eb5100d40a9b4745fa
Author: Mark McClain <email address hidden>
Date: Tue Sep 4 19:50:00 2012 -0400

    add rootwrap filters to wrap ip netns exec

    fixes bug 1044083

    This patch adds specific filters for the ip command. The first filter
    matches ip with any subcomand except netns exec. The second filter
    matches "ip netns exec" and then relies on the caller (match_filter) to
    verify the sub-command against the other filters. Matching the
    subcommand separately allows for a single set of filter definitions that
    work with and without namespaces.

    Change-Id: Ifd0378dc3461f84867efb3cb60396d9cfa9e582d