Improving How OpenStack Nova Runs Privileged Commands
OpenStack release manager Thierry Carrez examines OpenStack Nova's current privilege model and how it's being improved with the root_helper option.
Right now, OpenStack uses sudo to escalate privileges when it needs to run a root command. The problem with this, says Thierry, is that sudo doesn't provide a way to efficiently filter commands…