rootwrap daemon doesn't close parent's file descriptors after forking

[Ralf Haferkamp]

When using the rootwrap daemon with neutron-openvswitch-agent, there is a "/usr/bin/neutron-rootwrap-daemon" which is listening on port 6633:

# ss -ptl | grep 6633
LISTEN 0 50 127.0.0.1:6633 *:* users:(("sudo",pid=11451,fd=3),("neutron-openvsw",pid=11430,fd=3))

That port is supposed to belong to neutron-openvswitch-agent for communicating with ovs-vswitchd. The rootwrap daemon "inherits" this port, because it doesn't close its filedescriptors (apart from stdin/out/err) after forking.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/425069

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/425069
Committed: https://git.openstack.org/cgit/openstack/oslo.rootwrap/commit/?id=458d79b61abb1a9ad36ce4868cf248ddb21c80a7
Submitter: Jenkins
Branch: master

commit 458d79b61abb1a9ad36ce4868cf248ddb21c80a7
Author: Ralf Haferkamp <email address hidden>
Date: Tue Jan 24 12:08:46 2017 +0100

    [daemon] Close inherited filedescriptors after forking

    We don't want to keep listening on the parent's sockets (e.g. when
    started by neutron-openvswitch agent) after forking the rootwrap
    daemon.

    Closes-Bug: #1658973
    Change-Id: I3e364e9d3ad4e2fcd6f4d8f52f847ec9fa944572

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/425607

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/435134

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/435134
Committed: https://git.openstack.org/cgit/openstack/oslo.rootwrap/commit/?id=f080dffdfd6b91b4fe99029fbd7a867b6e1141cf
Submitter: Jenkins
Branch: stable/ocata

commit f080dffdfd6b91b4fe99029fbd7a867b6e1141cf
Author: Ralf Haferkamp <email address hidden>
Date: Tue Jan 24 12:08:46 2017 +0100

    [daemon] Close inherited filedescriptors after forking

    We don't want to keep listening on the parent's sockets (e.g. when
    started by neutron-openvswitch agent) after forking the rootwrap
    daemon.

    Closes-Bug: #1658973
    Change-Id: I3e364e9d3ad4e2fcd6f4d8f52f847ec9fa944572
    (cherry picked from commit 458d79b61abb1a9ad36ce4868cf248ddb21c80a7)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/425607
Committed: https://git.openstack.org/cgit/openstack/oslo.rootwrap/commit/?id=f8fbd3efe409e2722ba94d749350d23d6aabff48
Submitter: Jenkins
Branch: stable/newton

commit f8fbd3efe409e2722ba94d749350d23d6aabff48
Author: Ralf Haferkamp <email address hidden>
Date: Tue Jan 24 12:08:46 2017 +0100

    [daemon] Close inherited filedescriptors after forking

    We don't want to keep listening on the parent's sockets (e.g. when
    started by neutron-openvswitch agent) after forking the rootwrap
    daemon.

    Closes-Bug: #1658973
    Change-Id: I3e364e9d3ad4e2fcd6f4d8f52f847ec9fa944572
    (cherry picked from commit 458d79b61abb1a9ad36ce4868cf248ddb21c80a7)

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/438816

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/oslo.rootwrap 5.5.0 release.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/438816
Committed: https://git.openstack.org/cgit/openstack/oslo.rootwrap/commit/?id=6285b63572c893391cb1a9e0c482658938f13329
Submitter: Jenkins
Branch: master

commit 6285b63572c893391cb1a9e0c482658938f13329
Author: IWAMOTO Toshihiro <email address hidden>
Date: Tue Feb 28 15:12:01 2017 +0900

    Allow rootwrap-daemon to timeout and exit

    If the client side abnormally exits, its rootwrap daemon cannot
    receive a shutdown message and will be left forever. Let it timeout
    and exit to save such cases.

    Change-Id: I783717b5fa019371747b98bf92965b6e689603f6
    Related-bug: #1658973
    Related-bug: #1658977
    Related-bug: #1663458

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/ocata
Review: https://review.openstack.org/448744

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/newton
Review: https://review.openstack.org/448745

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/448744
Committed: https://git.openstack.org/cgit/openstack/oslo.rootwrap/commit/?id=fdacd0e60817db8455b3c2f21b60e8a2130953aa
Submitter: Jenkins
Branch: stable/ocata

commit fdacd0e60817db8455b3c2f21b60e8a2130953aa
Author: IWAMOTO Toshihiro <email address hidden>
Date: Tue Feb 28 15:12:01 2017 +0900

    Allow rootwrap-daemon to timeout and exit

    If the client side abnormally exits, its rootwrap daemon cannot
    receive a shutdown message and will be left forever. Let it timeout
    and exit to save such cases.

    Change-Id: I783717b5fa019371747b98bf92965b6e689603f6
    Related-bug: #1658973
    Related-bug: #1658977
    Related-bug: #1663458
    (cherry picked from commit 6285b63572c893391cb1a9e0c482658938f13329)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/448745
Committed: https://git.openstack.org/cgit/openstack/oslo.rootwrap/commit/?id=af8ad2da809f68442da9aacd17a47bca342eb355
Submitter: Jenkins
Branch: stable/newton

commit af8ad2da809f68442da9aacd17a47bca342eb355
Author: IWAMOTO Toshihiro <email address hidden>
Date: Tue Feb 28 15:12:01 2017 +0900

    Allow rootwrap-daemon to timeout and exit

    If the client side abnormally exits, its rootwrap daemon cannot
    receive a shutdown message and will be left forever. Let it timeout
    and exit to save such cases.

    Change-Id: I783717b5fa019371747b98bf92965b6e689603f6
    Related-bug: #1658973
    Related-bug: #1658977
    Related-bug: #1663458
    (cherry picked from commit 6285b63572c893391cb1a9e0c482658938f13329)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/oslo.rootwrap 5.1.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/oslo.rootwrap 5.4.1 release.