Bug 894460 - Configure ComputeNodes so that libvirt is R/O for all users except for Nova
Configure ComputeNodes so that libvirt is R/O for all users except for Nova
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-packstack (Show other bugs)
2.0 (Folsom)
Unspecified Unspecified
medium Severity low
: ---
: 5.0 (RHEL 7)
Assigned To: Lukas Bezdicka
Ami Jeain
: CodeChange, FutureFeature, Improvement, Triaged, ZStream
Depends On:
  Show dependency treegraph
Reported: 2013-01-11 15:07 EST by Perry Myers
Modified: 2015-06-04 17:50 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-09-18 06:00:41 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Perry Myers 2013-01-11 15:07:43 EST
Description of problem:
It could be problematic if admins can run virsh destroy/undefine on ComputeNodes outside of Nova, since that may cause state to get messed up between ComputeNodes and Nova.

So it might be desirable to make libvirt connections read-only for all users except for Nova.

This should be optional though.  Some users may want their admins to have virsh access to VMs even despite the risks.
Comment 2 Daniel Berrange 2014-09-17 11:14:09 EDT
I think that this is something we should not do.  RHEV made libvirt inaccessible to the root user and it has been a total PITA for anyone logging into a box to troubleshoot the system.

If a person has been given root they are all powerful and know they should be careful. We don't need to add child-locks to their account wrt libvirt, which ultimately don't achieve anything besides annoyance for people who need access.
Comment 3 Daniel Berrange 2014-09-17 11:17:15 EDT
BTW, Nova copes fine if you 'virsh destroy' a running nova guest - it just transitions it to the shutoff state.

Note You need to log in before you can comment on or make changes to this bug.