Agents don't need root to list namespaces

[Carl Baldwin]

Given the expense of sudo (at scale) and rootwrap calls, agents should not be using root for commands that don't need it. Listing namespaces is one of those.

(I could have sworn I already fixed this which is why I didn't fix it until today)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/81098

[Miguel Angel Ajo (mangelajo)]

Good catch!!

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/81098
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=d37b6c9ee8ddf2cc90197e5a442ba759eca5a0c0
Submitter: Jenkins
Branch: master

commit d37b6c9ee8ddf2cc90197e5a442ba759eca5a0c0
Author: Carl Baldwin <email address hidden>
Date: Mon Mar 17 22:19:04 2014 +0000

    Don't use root to list namespaces

    A bit of low hanging fruit. I just noticed that this hadn't been
    fixed yet.

    Change-Id: Iea9210098b6acf4ab24a89287529ff82986faaad
    Closes-Bug: #1293818

[Eugene Nikanorov (enikanorov)]

Apparently the fix is not correct since the code calls exactly same commands.

[Akihiro Motoki (amotoki)]

A new fix is proposed: https://review.openstack.org/#/c/81537/

[Carl Baldwin (carl-baldwin)]

Eugene, can you elaborate? For the case that I found and for which I filed the bug this change very clearly fixed the problem in my testing. After the change, I see this in the logs. I don't see any case of running "netns list" with rootwrap.

2014-03-24 15:13:52.252 DEBUG neutron.agent.linux.utils [req-52cb3fa7-7de1-4242-9f52-2cfb92e637b1 None None] Running command: ['ip', '-o', 'netns', 'list'] from (pid=32640) create_process /opt/stack/neutron/neutron/agent/linux/utils.py:48
2014-03-24 15:13:52.260 DEBUG neutron.agent.linux.utils [req-52cb3fa7-7de1-4242-9f52-2cfb92e637b1 None None]
Command: ['ip', '-o', 'netns', 'list']
Exit code: 0

[Carl Baldwin (carl-baldwin)]

Eugene,

Nevermind, your logs you pasted in the review of your code answered my question. I see the problem.