Privsep fails when running in a virtual environment

[Gorka Eguileor]

If we are running in a virtual environment created by a normal user and use os-brick using privsep we get the following error:

2020-06-18 10:17:53.618 480685 CRITICAL cinder [req-a3a1b511-dc64-4804-8c3b-7579e3904b45 cinderlib cinderlib - - -] Unhandled error: ModuleNotFoundError: No module named 'os_brick.privileged.rootwrap'
2020-06-18 10:17:53.618 480685 ERROR cinder Traceback (most recent call last):
2020-06-18 10:17:53.618 480685 ERROR cinder File "<stdin>", line 1, in <module>
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/cinderlib/cinderlib/objects.py", line 549, in attach
2020-06-18 10:17:53.618 480685 ERROR cinder self.backend.configuration.enforce_multipath_for_image_xfer)
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/cinder/utils.py", line 441, in brick_get_connector_properties
2020-06-18 10:17:53.618 480685 ERROR cinder enforce_multipath)
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/os_brick/utils.py", line 157, in trace_logging_wrapper
2020-06-18 10:17:53.618 480685 ERROR cinder result = f(*args, **kwargs)
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/os_brick/initiator/connector.py", line 256, in get_connector_properties
2020-06-18 10:17:53.618 480685 ERROR cinder execute=execute))
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/os_brick/initiator/connectors/iscsi.py", line 68, in get_connector_properties
2020-06-18 10:17:53.618 480685 ERROR cinder initiator = iscsi.get_initiator()
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/os_brick/initiator/connectors/iscsi.py", line 971, in get_initiator
2020-06-18 10:17:53.618 480685 ERROR cinder root_helper=self._root_helper)
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/os_brick/executor.py", line 52, in _execute
2020-06-18 10:17:53.618 480685 ERROR cinder result = self.__execute(*args, **kwargs)
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/os_brick/privileged/rootwrap.py", line 169, in execute
2020-06-18 10:17:53.618 480685 ERROR cinder return execute_root(*cmd, **kwargs)
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/oslo_privsep/priv_context.py", line 247, in _wrap
2020-06-18 10:17:53.618 480685 ERROR cinder return self.channel.remote_call(name, args, kwargs)
2020-06-18 10:17:53.618 480685 ERROR cinder File "/home/vagrant/venv2/lib/python3.7/site-packages/oslo_privsep/daemon.py", line 204, in remote_call
2020-06-18 10:17:53.618 480685 ERROR cinder raise exc_type(*result[2])
2020-06-18 10:17:53.618 480685 ERROR cinder ModuleNotFoundError: No module named 'os_brick.privileged.rootwrap'
2020-06-18 10:17:53.618 480685 ERROR cinder

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/736615

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/736615
Committed: https://git.openstack.org/cgit/openstack/os-brick/commit/?id=5d5f8e02efa6854bef0813e0e8383a3760cf93d2
Submitter: Zuul
Branch: master

commit 5d5f8e02efa6854bef0813e0e8383a3760cf93d2
Author: Gorka Eguileor <email address hidden>
Date: Thu Jun 18 13:12:06 2020 +0200

    Fix os-brick in virtual environments

    When running os-brick in a virtual environment created by a non root
    user, we get the following error:

      ModuleNotFoundError: No module named 'os_brick.privileged.rootwrap'

    This happens because the privsep daemon drops all the privileged except
    those defined in the context, and our current context doesn't bypass
    file read permission checks, so the Daemon cannot read the file with the
    code it was asked to run, because it belongs to a different user.

    This patch adds the CAP_DAC_READ_SEARCH capability to our privsep
    context so we can load the libraries, but only when we are running on a
    virtual environment to follow the principle of least privilege.

    This bug doesn't affect system-wide installations because the files
    installed under /sys/python*/site-packages belong to the Daemon user
    (root), so no special capabilities are necessary.

    Change-Id: Ib191c075ad1250822f6ac842f39214af8f3a02f0
    Close-Bug: #1884059

[Gorka Eguileor (gorka)]

This was fixed and released in Victoria.