Grizzly quantum rootwrapper imports quantum code

[Dirk Mueller]

https://review.openstack.org/#/c/13536/

introduced loading of quantum.utils into rootwrap, which is both slow (as it loads a lot of other modules that nobody needs) and a potential security issue due to the amount of code being run as root. While I don't know of a way to exploit this I think it is a potential risk.

I suggest this part to be reverted for the quantum rootwrapper.

[yong sheng gong (gongysh)]

I think it makes sense.

[Mark McClain (markmcclain)]

The work to unify Oslo's rootwrap will address this.

See https://blueprints.launchpad.net/quantum/+spec/quantum-common-rootwrap

[Dirk Mueller (dmllr)]

The problem is only in the Grizzly branch of Quantum, it is already solved for Havana, thats correct. There is still a need to have it sovled for Grizzly, I think.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/32922
Committed: http://github.com/openstack/quantum/commit/8917451b3686a1a2c1366322447bab829238cc88
Submitter: Jenkins
Branch: stable/grizzly

commit 8917451b3686a1a2c1366322447bab829238cc88
Author: Dirk Mueller <email address hidden>
Date: Thu Jun 13 18:52:37 2013 +0200

    Do not import anything from quantum into rootwrap

    The rootwrapper is special and shouldn't do heavy code
    loading, first for performance and 2nd for potential
    security issues.

    It shaves off 0.2s of load time (aka heavy cpu usage when
    using openvswitch as it invokes rootwrap twice every 4 seconds)

    Fixes LP bug 1190675

    This is reverting bug 1053381

        Author: Gary Kotton <email address hidden>
        Date: Sun Sep 23 08:34:33 2012 +0000

            Uses a common subprocess popen function

    Change-Id: I629d90aaeb99b225d716da82c6ac5c3f327ebb67