Runing kuryr-libnetworks not from root user fails
Bug #1852105 reported by
Dmitriy Rabotyagov
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
kuryr |
In Progress
|
High
|
Unassigned | ||
kuryr-libnetwork |
In Progress
|
High
|
Unassigned |
Bug Description
I'm trying to run kuryr-libnetwork as not privileged user (kuryr) with systemd-service, by setting AmbientCapabilities and CapabilityBound
However, when I try to verify it's operation I have the following trace: http://
AFAIK, using oslo_concurrency execute as root requires setting rootwrap, which is not the case: https:/
But running kuryr as root is not really secure IMO especially when rootwrap is used everywhere.
Changed in kuryr: | |
status: | New → In Progress |
Changed in kuryr-libnetwork: | |
status: | New → In Progress |
importance: | Undecided → High |
Changed in kuryr: | |
importance: | Undecided → High |
To post a comment you must log in.
I've pushed a change to https:/ /review. opendev. org/c/openstack /kuryr/ +/764908 which I believe should help with this, provided 'AmbientCapabil ities' are still used for non-root users.
I had a go at a couple of alternatives with root helpers or privsep too, but this doesn't appear to avoid the need for an ambient capability due to what happens within the 'pyroute2' library: /github. com/bbc/ kuryr/tree/ root-helper /github. com/bbc/ kuryr/tree/ privsep
- https:/
- https:/