oslo-rootwrap gives up matching if first chaining filter fails

[Tomoki Sekiyama]

When there are multiple chaining filters that may match on the specified arguments, oslo-rootwrap gives up matching if first chaining filter reject the arguments, even though latter filters can accept them.

For example, /etc/cinder/rootwrap.d/volume.filters has :

dd: CommandFilter, dd, root
ionice_1: ChainingRegExpFilter, ionice, root, ionice, -c[0-3]
ionice_2: ChainingRegExpFilter, ionice, root, ionice, -c[0-3], -n[0-7]

and then

% sudo cinder-rootwrap /etc/cinder/rootwrap.conf ionice -c2 -n7 dd if=/dev/zero of=/dev/sda1
/usr/bin/cinder-rootwrap: Unauthorized command: ionice -c2 -n7 dd if=/dev/zero of=/dev/sda1 (no filter matched)

However, if /etc/cinder/rootwrap.d/volume.filters has :

dd: CommandFilter, dd, root
ionice_2: ChainingRegExpFilter, ionice, root, ionice, -c[0-3], -n[0-7]
ionice_1: ChainingRegExpFilter, ionice, root, ionice, -c[0-3]

it accepts the command.

This is because, in the former case, the first filter "ionice_1" hits to "ionice -c2" part but "-n7 dd ..." is denied by leaf filters, then oslo-rootwrap gives up further matching.

[Tomoki Sekiyama (tsekiyama)]

Fix for this bug is already merged: https://review.openstack.org/#/c/106071/

[Ben Nemec (bnemec)]

Have we done a release since the fix merged? Tomoki mentioned in #openstack-oslo that it wasn't available in CI yet.

[Thierry Carrez (ttx)]

@Ben: not yet, that fix went in just after 1.3.0.0a1. i'll look into doing a new release ASAP, but some pretty significant changes landed and we need to check a few things first.