CommandFilter does not allow validating full path command

[David Vallee Delisle]

If we use this configuration:
sftp_server: CommandFilter, /usr/libexec/openssh/sftp-server, root

rootwrap can't validate full paths
~~~
# /usr/bin/nova-rootwrap /etc/nova/migration/rootwrap.conf /usr/libexec/openssh/sftp-server
/usr/bin/nova-rootwrap: Unauthorized command: /usr/libexec/openssh/sftp-server (no filter matched)
~~~

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/oslo.rootwrap/+/823571
Committed: https://opendev.org/openstack/oslo.rootwrap/commit/1b1b960d0d6b0ddf63c5b0f9c6aa7c10a1914073
Submitter: "Zuul (22348)"
Branch: master

commit 1b1b960d0d6b0ddf63c5b0f9c6aa7c10a1914073
Author: David Vallee Delisle <email address hidden>
Date: Wed Jan 5 12:36:04 2022 -0500

    CommandFilter should allow exec from full path

    The current logic prevents from using a full path as argument.
    We can't just compare basename to basename as it would allow passing
    bogus paths. We need to make sure that passing a full path will compare
    to the config's full path.

    Closes-Bug: #1956606

    Change-Id: I76094065de5b37f59a2500fbce7f500ada9915da

[Bogdan Dobrelya (bogdando)]

Could you please backport for Wallaby?

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/oslo.rootwrap 6.3.1 release.