nova-idmapshift is missing its rootwrap filter

[gustavo panizzo]

when i try to boot a vm using lxc idmap the following error appears on nova-compute log

2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] File "/usr/lib/python2.7/dist-packages/nova/utils.py", line 206, in execute
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] return processutils.execute(*cmd, **kwargs)
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] File "/usr/lib/python2.7/dist-packages/oslo_concurrency/processutils.py", line 233, in execute
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] cmd=sanitized_cmd)
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] ProcessExecutionError: Unexpected error while running command.
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] Command: sudo nova-rootwrap /etc/nova/rootwrap.conf nova-idmapshift -i -u 0:1000:100 -g 0:1000:100 /var/lib/nova/instances/2c776372-1fa2-4b19-83aa-8358b7212d06/rootfs
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] Exit code: 99
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] Stdout: u''
2015-05-06 14:46:10.827 8940 TRACE nova.compute.manager [instance: 2c776372-1fa2-4b19-83aa-8358b7212d06] Stderr: u'/usr/bin/nova-rootwrap: Unauthorized command: nova-idmapshift -i -u 0:1000:100 -g 0:1000:100 /var/lib/nova/instances/2c776372-1fa2-4b19-83aa-8358b7212d06/rootfs (no filter matched)\n'

i check on nova's source (both kilo and master) and there is no rootwrap filter for nova-idmap.

i will provide a patch

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/180451

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/180451
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=056a77699f87480ec94705349b0a501753d16081
Submitter: Jenkins
Branch: master

commit 056a77699f87480ec94705349b0a501753d16081
Author: gustavo panizzo <email address hidden>
Date: Wed May 6 16:58:55 2015 +0800

    Add nova-idmapshift to rootwrap filters

    nova-idmapshift is missing the rootwrap filter it needs to run as root.
    This commit adds those filters.

    Change-Id: I96572a495628cc072392e1d7248699450b3e0aeb
    Closes-Bug: #1452143